badgebot

Key things to consider before installing: 1) Metadata mismatch: ask the publisher why the registry lists no required credentials while the instructions require Slack, Apollo, and HubSpot tokens stored in specific files. Prefer skills that declare required credentials explicitly. 2) Least privilege: create dedicated, minimal-scope API tokens (Slack bot token limited to the single channel and DM actions, Apollo/HubSpot tokens scoped as narrowly as possible). Avoid using owner/global admin tokens. 3) Test in staging: run the skill in a non-production/test workspace and portal to verify behavior and that only intended messages are read/updated. 4) Inspect provenance: request source code or a homepage from the publisher (none is provided). Without source or a trusted publisher, exercise extra caution. 5) Data exposure and compliance: the skill enriches with personal emails (reveal_personal_emails=true) and stores lead data in local state and logs — ensure this matches your data-handling and privacy policies. 6) Rotation & monitoring: if you try it, use short-lived tokens where possible and rotate them after testing; monitor API call patterns and logs for unexpected activity. If the publisher cannot explain the missing metadata or provide source, treat the skill as higher risk and avoid installing it with privileged credentials.