Datacomply Shield

This skill describes a cloud-based pipeline that will upload and process documents with external services (GMI Cloud, embeddings, Pinecone, etc.), but it declares no required credentials or endpoints. Before installing or using it with sensitive documents: - Ask the publisher for a clear list of required environment variables (API keys, endpoints, DB URLs) and why each is needed. The skill should declare these in its metadata. - Ask where uploaded documents and embeddings are stored, for how long, and which legal jurisdictions/regions the services operate in (data residency). Request a privacy/data handling policy and retention rules. - Request proof of the service endpoints (official domains) and a security/audit statement (who can access stored documents, audit logs, and deletion procedures). Prefer well-known service hosts over arbitrary endpoints. - If you must test, do so with non-production/example documents and redact PII. Do not upload real customer data until you obtain the above assurances. - Prefer skills that explicitly list needed credentials and document how they protect or limit data exfiltration, or ask for source code/auditable implementation if available. Given the clear mismatch between what the instructions do and what the metadata declares, treat this skill as suspicious until the provider clarifies credentials, endpoints, and data handling.