Outbound Campaign

This skill appears to do what it claims (scrape leads, craft sequences, call Apify and InVideo), but the registry metadata omits the API keys it obviously needs and the runtime instructions involve scraping personal data and sending it to third parties. Before installing or running it: - Ask the publisher to update the registry metadata to explicitly declare required env vars (apify_token, invideo_api_key, and any Claude/other keys) and to state required scopes and minimum permissions for those tokens. - Request a clear list of external endpoints the skill will call (Apify actor IDs/URLs, InVideo endpoints, Claude endpoints) so you can audit traffic and firewall rules. - Confirm whether the skill requires any LinkedIn credentials or browser automation that would expose your account — the SKILL.md references LinkedIn scraping but doesn't say how it's authenticated. - Consider legal/privacy implications and platform TOS: scraping and storing personal LinkedIn/profile/email data can violate terms or privacy laws; get consent where required. - Use least-privilege test tokens (non-production accounts) when evaluating, and monitor network calls. - If you need stronger assurance, ask for the exact implementation (Apify actor IDs or code) so you or a reviewer can audit what data is extracted and transmitted. Given these mismatches and the sensitive nature of the operations, treat the skill as untrusted until the publisher provides the clarifications above.