Financial Product Workflow

Do not provide any API tokens or secrets until you confirm exactly which scripts and runtime behaviors are present. Specific steps to reduce risk: - Verify repository contents: the docs reference a scripts/ directory and many integration scripts (Jira/Confluence/Git/DingTalk/SensorsData). Confirm those scripts actually exist and inspect their code before running them. - Confirm metadata vs behavior: ask the skill author to update registry metadata to list the exact environment variables the skill needs and why. Declared requirements should match SKILL.md. - Use least-privilege credentials: create tokens with minimal scopes (e.g., a Jira token limited to a single project) and test in a staging account, not production. - Run in an isolated environment: if you try the skill's automation, do so in a sandboxed account or org where mistakes or data leaks are low impact. - Prefer manual (Level 3) mode first: the skill supports markdown/mermaid downgrade outputs — use that to produce docs you copy into your systems rather than giving the skill direct API access. - If you plan to enable automated integrations, perform a code review or request the scripts and integration code, and confirm they do not exfiltrate data to unknown endpoints. If the author cannot or will not clarify why metadata omits required env vars and provide the actual scripts, treat the skill as potentially unsafe for automatic credentialed integration.