HeyLead

This skill does roughly what it says (autonomous LinkedIn outreach), but there are several inconsistencies you should resolve before installing: - Verify the upstream project: inspect the GitHub repo and the PyPI package source (the SKILL.md links exist, but 'source: unknown' in metadata is concerning). Make sure the heylead package you install is the same code the skill documents. - Clarify the installer command ('uv' vs 'uvx'): ask the author which binary you must install and where it comes from. Avoid running curl | sh on an unknown host without reviewing the install script contents. - Confirm data flows and storage: the skill claims local-only storage for contacts/messages but also says LLM calls can route through HeyLead backend. Ask whether messages or metadata are transmitted to HeyLead servers and whether any tokens are retained server-side. - Prefer using your own LLM key and verify how/where that key is stored. If possible, test in an isolated environment or sandbox account before connecting production LinkedIn/Google accounts. - Expect to paste OAuth tokens during setup; ensure you understand what the token scope is (read/write messages, connections, profile) and revoke it if you uninstall. If you cannot get clear answers to the above, treat the skill as higher-risk and avoid provisioning it with real accounts or sensitive credentials.