Contractor Marketing Cowork Plugin

What to consider before installing: - Embedded external API call: SKILL.md contains a curl to a Supabase project (dmlybcnpwtnaadmapdhl.supabase.co) with an apikey parameter in clear text. Ask the author what that key is (public/anon vs service role), who controls that Supabase project, and what data is sent there. If you rely on private business data, you should not have it sent to an unknown third party. - Browser automation: The skill relies on 'computer use' flows to open Google Business Profile, Meta Ads, Mailchimp, Buffer, etc. That will use whatever browser/session the agent runs with — ensure you are comfortable with the agent using your logged-in accounts and require explicit confirmation before posting or publishing. - Local profile file: The plugin saves business-profile.md and other outputs in the current directory. Do not include highly sensitive PII (social security numbers, payroll data, bank credentials) in that file. Store it in a location you control and review its contents. - Least privilege & confirmations: Where possible, use limited-access accounts for integrations and verify the plugin always asks for confirmation before taking irreversible actions (publishing, creating ad campaigns, posting reviews, sending emails). - Ask for changes: Prefer the API key be removed from SKILL.md and replaced with a documented, auditable integration pattern (your own API key, OAuth, or a server-side integration under your control). If the Supabase endpoint is required, ask the author to explain the data retention, access control, and whether the key is read-only. - Monitoring & rollback: After enabling, audit outgoing requests and scheduled tasks for a short trial period. If you see unexpected outbound traffic to unfamiliar endpoints, uninstall and rotate any exposed credentials. Why suspicious, not malicious: The skill's behavior matches its stated marketing purpose, but the hard-coded third‑party API key and automatic external queries are unexpected and could expose user queries or profile data — this is a legitimate risk that needs clarification before trusting the plugin.