Jobs Skill

Things to check before installing: - Confirm required credentials: Ask the skill author or registry to declare SUPABASE_URL and which key(s) are required in the metadata (primaryEnv). Don’t proceed until the manifest matches runtime requirements. - Use least-privilege credentials: Provide a scoped runtime key that only permits the exact table operations the skill needs (profiles/needs/matches/events). Avoid giving full admin keys. - Evaluate privacy risks: The skill returns full profile fields (emails, current_company, etc.). Ensure you are comfortable with that data flow and that recruiters are authorized recipients. Confirm retention, logging, and deletion policies. - Secret handling: Verify the platform secret store will be used and that credentials won’t be written to disk unless you explicitly allow it. Ask how checkpoints are stored and who can access them. - Test in staging: Run the skill against a disposable/test Supabase project first to confirm behavior and least-privilege enforcement. - Ask about access controls: Confirm how the skill enforces per-recruiter / per-candidate visibility and whether it will inadvertently widen read access. - Demand transparency: Because the manifest omitted required env vars, ask the owner to update registry metadata to list required env vars and the primary credential. If the owner cannot or will not provide this, consider it untrustworthy. If you cannot get clear answers or a corrected manifest, proceed cautiously or do not install.