lfg

Before installing or enabling this skill, consider the following: - Inconsistency: SKILL.md requires a local 'lgf' CLI and two API keys (TAVILY_API_KEY, OPENROUTER_API_KEY), but the registry metadata does not list those requirements. Treat this as a warning sign. - Verify the source: inspect the GitHub repository (https://github.com/Catafal/lead-gen-factory.git) yourself. Review the code (especially install/setup scripts) and check issues/stars/maintainer reputation before pip-installing. - Avoid installing system-wide: if you decide to install, do so in an isolated environment (VM, container, or dedicated user account) or use pipx with isolation, and avoid providing high‑privilege credentials. - Use least-privilege credentials: create dedicated API keys with limited scope and rotate them if used for testing. Do not reuse sensitive production keys. - Protect secrets on disk: SKILL.md points at ~/.lgf/.env — ensure its permissions are restrictive and be aware that the agent (with Read permission) could access that file. - Confirm registry metadata: ask the publisher to update the skill manifest to declare required binaries and env vars formally, and to provide an install spec referencing a vetted release (e.g., GitHub release tarball or PyPI package) rather than a raw git URL if possible. If you cannot review the repository or prefer lower risk, do not install the CLI and instead look for a skill that either provides a vetted install spec or is purely instruction-only without requiring new system binaries or undeclared credentials.