AnveVoice

This skill appears to be what it says — a SaaS voice widget — but review and confirm a few things before installing: - Verify the API key: create a key with the minimum scopes needed (avoid a single 'full_access' key). Use separate dev/staging/prod keys and rotate/revoke as needed. - Confirm the vendor: the package metadata is missing a homepage in the registry but the SKILL.md/README point to https://anvevoice.com — visit that site, confirm contact/support channels, and validate the developer identity before trusting keys. - Privacy & consent: embedding the widget will request microphone access and send voice recordings, transcripts, and page metadata to AnveVoice servers. Ensure you disclose this in your privacy policy and obtain user consent. If you handle regulated data (PHI), get a BAA before sending any protected information. - Endpoint verification: SECURITY.md lists a Supabase project and specific function endpoints. Treat these as the service endpoints; if you require on-prem or self-hosted options, confirm with the vendor. - Test with non-sensitive data first: deploy in a staging environment, validate retention/auto-delete settings, and monitor usage in the dashboard for unexpected activity. - Metadata inconsistency: the registry metadata omitted the required env var while SKILL.md requires ANVEVOICE_API_KEY. This is likely a packaging oversight but verify the key requirement before use. If you are comfortable after these checks, using the skill is coherent with its stated purpose. If any of the verification steps fail (vendor unreachable, unclear privacy guarantees, or you cannot limit key scope), treat installation as risky.