lead-generating

This skill appears to do what it says (lead capture, storing conversations, triggering automations) but it asks you to provide a Supabase Service Role Key — a full-access credential that bypasses Supabase row-level security and can read/write any table. Before installing, consider: - Avoid giving the agent the Service Role Key unless the skill runs in a trusted, server-side environment you control. Prefer using an Anon/public key with properly configured RLS policies, or a narrowly scoped server-side token that only allows the required inserts/queries. - Ask the skill author why the Service Role Key is required and whether the skill can work with RLS or a restricted API key. - Verify where the key will be stored by your platform (is it encrypted/secret-scoped?) and whether the agent runtime could leak it to logs or remote endpoints. - Review and/or run the code in a staging environment to confirm the skill only accesses the declared Supabase tables and does not call unexpected external endpoints. There are references to Make.com/Resend in docs, but no hardcoded webhook URLs in the code — you will need to configure those automations yourself. - Rotate the key after testing and monitor Supabase logs for unexpected queries. If you cannot host the skill in a trusted server-side environment or cannot supply a narrowly scoped credential, treat this skill as unsafe to run with a Service Role Key.