Larry Marketing

This skill appears to implement what it claims (image generation, overlays, multi-platform posting via Upload-Post, analytics, optional RevenueCat correlation), but there are important mismatches you should address before installing: - Metadata vs reality: The registry metadata declares no required credentials, but the scripts expect an Upload-Post API key (required) and optionally OpenAI/Stability/Replicate keys and RevenueCat secret keys in a local config.json. Do not assume the platform will inject these — you'll need to provide them and they are sensitive. - Limit secrets: Use minimal-scope or throwaway accounts where possible (a dedicated Upload-Post account, or API key scoped for only the needed endpoints). Treat RevenueCat V1 secret keys like full-production secrets; only provide them if you understand the implications. - Review outgoing endpoints: The code calls api.upload-post.com and RevenueCat endpoints. Verify those domains and the Upload-Post service are trustworthy for your use case before giving API keys. - Inspect the rest of the code: Several files were truncated in the package listing. Review all scripts for any additional outgoing endpoints or hidden behavior before running. - Run in a sandbox first: Install and run the scripts in a controlled environment (separate directory, container, or VM) to see what files are created and what network calls occur. Check network logs for unexpected destinations. - Browser/agent behavior: The skill wants to perform browser-based competitor research and to "IMMEDIATELY start a conversation" on load. Ensure your agent is configured to ask permission before browsing and that you expect the onboarding prompt. If you need a concise checklist to proceed: (1) manually inspect all files, (2) create dedicated API keys with minimal privileges, (3) run in a sandbox, and (4) do not provide your primary RevenueCat or production keys until you confirm the behavior and trust the Upload-Post service.