Bid Proposal Manager

What to check before installing/using this skill: - Manifest mismatch: The skill's code and documentation clearly require credentials (DATABASE_URL / psql access, NOTION_API_KEY, and optionally OPENAI_API_KEY or OLLAMA_BASE_URL), but the SKILL metadata declares no required environment variables. Treat this as a red flag: ask the publisher to update the manifest to list required env vars and explain why each is needed. - Limit credentials and scope: If you test/run it, create a dedicated PostgreSQL user and database with minimal privileges (not a superuser). Do not supply production DB credentials or admin accounts. For Notion, create an integration and grant it access only to the specific database/page you want the skill to manage. - Review network endpoints: The included scripts use requests for web fetch and Notion; ensure the Notion API key is only used for api.notion.com and that embedding provider endpoints (OpenAI/Ollama) are the expected official endpoints. If you must supply an OpenAI key, remember that data sent to OpenAI may leave your environment — avoid sending sensitive documents. - Run in an isolated environment: Try the skill in a sandboxed VM or container. Install dependencies manually following the setup_guide and inspect runtime behavior (network connections, DB writes) before providing real credentials or real data. - Check data retention and raw text storage: The DB schema stores raw_text and embeddings. Decide whether storing full document text in your DB is acceptable and ensure DB access is secured. - Ask for fixes/clarifications: Request that the skill author update SKILL.md/manifest to list required env vars (DATABASE_URL, NOTION_API_KEY, EMBEDDING_PROVIDER, optional OPENAI_API_KEY/OLLAMA_BASE_URL), and document exactly which network calls and external services will be used. Without these manifest updates the skill's declared requirements are inconsistent with its actual behavior. - If unsure, get a code review: If you cannot verify these points yourself, have a trusted engineer audit the code for any hidden exfil endpoints or unexpected file/system access before use.