people-search

Search, qualify, and enrich people and companies. Use this skill whenever the user wants to find professionals, candidates, or KOLs by title, company, locati...

Security Scan

The skill's instructions generally match a people-search/enrichment tool, but several runtime behaviors (auto-install via npm/npx, writing tokens to your home dir, and recommending edits to other agents' MCP configs / running an MCP server) expand its reach in ways the manifest does not explicitly declare.

Purpose & Capability

The name/description (search & enrich people/companies) align with the runtime instructions: CLI and MCP modes call Lessie tools (find-people, enrich-people, enrich-org, web-search, web-fetch, etc.). Required capabilities and commands are coherent with the stated purpose.

Instruction Scope

The SKILL.md instructs the agent to: detect and auto-install the Lessie CLI (npm install -g @lessie/cli or npx), run auth flows that open a browser and store a token at ~/.lessie/oauth.json, call remote tools and generic 'lessie call' (which sends arbitrary JSON to the remote server), and resolve domains via web_search/web_fetch. These are largely expected, but the mode-detection flow includes an automatic npm install step (no explicit requirement to ask the user before attempting installation), and the skill will activate whenever the user mentions finding people — this wide trigger plus auto-install increases risk of unexpected network activity. The instructions also propose adding entries to various MCP config files and using MCP server tooling to connect to app.lessie.ai, which reaches beyond local-only behavior.

Install Mechanism

There is no registry install spec in the package manifest, but the README instructs use of npm / npx to fetch @lessie/cli and @lessie/mcp-server from the npm registry. Using npm/npx to run remote code is a common pattern but has moderate risk because it executes code fetched from the public registry at runtime; no direct binary downloads from arbitrary URLs are used. The instruction to auto-install globally (npm install -g) is more intrusive than a purely instruction-only skill that simply calls preinstalled tools.

Credentials

The skill declares no required environment variables or credentials, which matches the registry metadata. However, runtime behavior includes creating/using ~/.lessie/oauth.json to cache auth tokens and optionally setting LESSIE_REMOTE_MCP_URL for MCP usage. The SKILL.md also instructs modifying user MCP config files (e.g., ~/.claude/mcp.json, ~/.cursor/mcp.json) to add the Lessie MCP server entry — this touches configuration files belonging to other clients and thus expands the scope of what the skill may read/write beyond its own folder.

Persistence & Privilege

always:false (good), but the skill's instructions include persisting an OAuth token under ~/.lessie and recommend adding entries to other clients' MCP config files to enable an MCP server. Running npx @lessie/mcp-server (via the MCP entry) would run remote code and register a remote tool endpoint that interacts with a third-party server (app.lessie.ai). That level of persistence and potential background connectivity is significant; it's not flagged in the manifest and could be surprising if performed automatically. Autonomous invocation by the model is allowed by default — combine that with auto-install and MCP server setup and the blast radius increases.

What to consider before installing

This skill appears to be a wrapper for the Lessie people-search service and mostly behaves as expected, but pay attention to these practical risks before installing or letting the agent run it automatically: - Installation and execution: The SKILL.md tells the agent to auto-install the Lessie CLI via npm/npx if not found. npm/npx will fetch and run code from the public registry — prefer to install the CLI yourself manually (verify package identity and versions) rather than allowing an agent to run npm install -g automatically. - Authentication and tokens: Authorization uses a browser flow and caches a token at ~/.lessie/oauth.json. Be aware an OAuth token stored in your home directory will be used for subsequent calls and may allow the Lessie server to access queries and results. If you want to control token location or lifetime, perform auth yourself and inspect ~/.lessie/oauth.json. - MCP config edits & remote MCP server: The skill encourages adding a Lessie MCP entry to other tools' MCP config files (e.g., ~/.claude/mcp.json) and running an MCP server that connects to https://app.lessie.ai. Editing other clients' config or running a background MCP server gives a remote service broader access and can be surprising—only do this if you trust Lessie and have reviewed the URL and package sources. - Auto-activation scope: The skill is meant to trigger on generic mentions of 'finding people' or 'sourcing' and may attempt network actions. If you prefer tight control, require explicit user consent before installing or invoking the skill. - Data & compliance: The skill will send search queries and profile data to Lessie's service. Make sure this is acceptable for your data sensitivity and legal compliance (GDPR, CAN-SPAM, etc.). - Mitigations: (1) Install the CLI yourself in a controlled environment and vet the npm package; (2) refuse automatic global installs; (3) avoid or review MCP config changes; (4) run the skill in a sandbox or isolated account if you need to test it; (5) read Lessie's privacy policy and terms and confirm the app.lessie.ai domain is legitimate before enabling MCP server. Given these trade-offs, only enable automatic installs or MCP server registration if you trust the Lessie service and are comfortable with tokens and config changes in your user profile.

Lessie — People Search & Enrichment

Setup

Lessie supports two modes: CLI (default, recommended) and MCP Server.

Mode A: CLI (default)

Install the Lessie CLI binary:

npm install -g @lessie/cli

Or use without installing:

npx @lessie/cli --version

First-time authorization:

lessie auth

This opens a browser for login/registration. Token is cached at ~/.lessie/oauth.json.

Verify connection:

lessie status

Mode B: MCP Server

Add to your MCP config (Claude Code ~/.claude/mcp.json, Cursor ~/.cursor/mcp.json, etc.):

{
  "mcpServers": {
    "lessie": {
      "command": "npx",
      "args": ["-y", "@lessie/mcp-server"],
      "env": {
        "LESSIE_REMOTE_MCP_URL": "https://app.lessie.ai/mcp-server/mcp"
      }
    }
  }
}

Uninstall

• CLI: npm uninstall -g @lessie/cli && rm -rf ~/.lessie/
• MCP: Remove the "lessie" entry from your .mcp.json and rm -rf ~/.lessie/

Quick start

After setup, try saying to Claude:

• "Find Engineering Managers at Stripe in San Francisco"
• "Look up Sam Altman's contact info"
• "Research OpenAI — recent news and open job postings"

Mode detection

Determine which mode to use at the start of each session:

1. Check if lessie CLI is available: run lessie status
2. If the command succeeds → use CLI mode (call tools via Bash)
3. If the command fails (not found) → attempt auto-install: npm install -g @lessie/cli
4. After install, run lessie status again to verify
5. If install succeeds → use CLI mode
6. If install fails (no npm, permission denied, network error, etc.) → check if MCP tools are available (authorize, use_lessie)
7. If MCP tools are available → use MCP mode
8. If neither → inform the user that installation failed and suggest manual install or MCP setup

Credits & Pricing

Lessie is a credit-based service.

New accounts receive free trial credits. View your balance and purchase more at https://lessie.ai/pricing.

The agent will disambiguate company names before searching to avoid wasting credits on wrong results.

Data & Privacy

• Data sources: Contact and company information is aggregated from publicly available sources (business directories, social profiles, corporate websites).
• Query logging: Search queries are logged for service improvement and abuse prevention. No query data is shared with third parties.
• Data compliance: Lessie follows applicable data protection regulations. Users are responsible for using retrieved contact data in compliance with local laws (GDPR, CAN-SPAM, etc.).
• Privacy policy: https://lessie.ai/privacy
• Terms of service: https://lessie.ai/terms-of-service

Authorization

CLI mode

1. Run lessie status to check token validity.
2. If authorized: false → run lessie auth to open browser for login.
3. After the user completes login, run lessie status again to confirm.

MCP mode

1. Call authorize to check connection status.
2. If already authorized → proceed to use tools directly.
3. If not authorized → authorize returns an authorization URL. Tell the user you need to open a browser for Lessie login/registration, and open it using the appropriate system command:
   • macOS: open "<url>"
   • Linux: xdg-open "<url>"
   • Windows: start "<url>"
4. Tell the user the browser has been opened and they need to complete login/registration.
5. After the user confirms, call authorize again to verify the connection.
6. If authorization fails (timeout, denied, port conflict), follow the diagnostic hints returned by authorize and retry.

Always inform the user before opening the browser — never silently redirect.

Agent behavior rules

CRITICAL: Confirm before every credit-consuming action

Every Lessie tool call costs credits. Credit costs per tool:

Tool	Cost
find-people	20 credits per search
enrich-people	1 credit × number of people (only charged for successful matches)
review-people	1 credit × number of people
enrich-org	1 credit
find-orgs	1 credit
job-postings	1 credit
company-news	1 credit
web-search	1 credit
web-fetch	1 credit

Before executing any command, you MUST:

1. Tell the user what you are about to do and the estimated cost (e.g., "I'll enrich 3 people — this costs ~3 credits").
2. Wait for explicit confirmation before executing.
3. Never batch multiple credit-consuming calls without confirming the full plan first.

Exception — skip confirmation if the user has explicitly said they don't want to be prompted (e.g., "don't ask me every time", "just do it", "skip confirmations"). In that case, proceed directly but still log what you executed and the credits spent after each call.

CRITICAL: Report credit usage after every call

After each conversation turn that involved one or more Lessie tool calls, append a one-line summary of credits consumed. Format:

Used <tool-name>, cost <N> credit(s).

If multiple tools were called in the same turn, combine them:

Used web-search + enrich-org, cost 2 credits total.

CRITICAL: Read references before first CLI call

Before executing any lessie CLI command for the first time in a session, you MUST read references/cli-reference.md to learn the exact parameter syntax. Do NOT guess parameter names — the CLI uses --filter with JSON, not --title/--company style flags.

Entity disambiguation

When a user mentions a company name that could refer to multiple entities (e.g., "Manus" could be Manus AI, Manus Bio, Manus Plus, etc.), disambiguate before searching:

1. Ask the user which company they mean, or present the top candidates and let them pick.
2. If context makes it unambiguous (e.g., user previously discussed AI agents), state your assumption and confirm: "你是指做 AI Agent 的 Manus AI (manus.im) 吗？"
3. Never silently assume one entity over another — wrong domain = wasted search credits and irrelevant results.

Tools overview

People

Tool	CLI command	When to use
find_people	lessie find-people	Discover people by title, company, location, seniority, audience. Default strategy is hybrid. If a request times out or fails, retry with --strategy saas_only — it's faster (~30s vs ~60s) and more stable, though recall may be lower
enrich_people	lessie enrich-people	Enrich known people with full profiles. Two paths: B2B (via linkedin_url or name+domain → email, phone, work history) and KOL (via twitter/instagram/tiktok/youtube username → follower count, social links). Max 10 per call
review_people	lessie review-people	Deep-qualify ambiguous candidates via web research — skip for obvious matches/mismatches

# Find people — uses --filter with JSON, NOT --title/--company flags
lessie find-people \
  --filter '{"person_titles":["Engineering Manager"],"organization_domains":["stripe.com"]}' \
  --checkpoint 'EMs at Stripe' \
  --strategy hybrid \
  --target-count 10

# Enrich people (B2B) — linkedin_url is best; fallback: name + domain
lessie enrich-people \
  --people '[{"linkedin_url":"https://www.linkedin.com/in/samaltman/"}]'

# Enrich people (B2B) — name + domain fallback
lessie enrich-people \
  --people '[{"first_name":"Sam","last_name":"Altman","domain":"openai.com"}]'

# Enrich people (B2B) — include personal emails
lessie enrich-people \
  --people '[{"first_name":"Sam","last_name":"Altman","domain":"openai.com"}]' \
  --include-personal-emails

# Enrich people (KOL) — Twitter/X
lessie enrich-people \
  --people '[{"twitter_screen_name":"elonmusk"}]'

# Enrich people (KOL) — Instagram
lessie enrich-people \
  --people '[{"instagram_username":"natgeo"}]'

# Enrich people (KOL) — TikTok
lessie enrich-people \
  --people '[{"tiktok_username":"charlidamelio"}]'

# Enrich people (KOL) — YouTube
lessie enrich-people \
  --people '[{"youtube_username":"MrBeast"}]'

# Review people — deep-qualify from a previous search
lessie review-people \
  --search-id 'mcp_xxx' \
  --person-ids '["id1","id2"]' \
  --checkpoints '[{"key":"Relevance","description":"...","title":"Relevance","category":"career"}]'

Companies

Tool	CLI command	When to use
find_organizations	lessie find-orgs	Discover companies by name, keyword, location, size, funding
enrich_organization	lessie enrich-org	Get full profile for known company domain(s) — industry, employees, funding, tech stack
get_company_job_postings	lessie job-postings	View active job openings (needs organization_id from enrich)
search_company_news	lessie company-news	Find recent news articles (needs organization_id from enrich)

# Find organizations
lessie find-orgs \
  --keyword-tags '["AI","SaaS"]' \
  --locations '["China"]' \
  --employees '["51,200"]'

# Enrich organization
lessie enrich-org --domains '["stripe.com"]'

# Job postings (needs org ID from enrich)
lessie job-postings --org-id '5f5e100...'

# Company news
lessie company-news --org-ids '["5f5e100..."]'

Web research

Tool	CLI command	When to use
web_search	lessie web-search	General web search; cached results make follow-up web_fetch free
web_fetch	lessie web-fetch	Extract specific info from a URL via AI summarization

# Web search
lessie web-search --query 'OpenAI official website' --count 5

# Web fetch
lessie web-fetch --url 'https://example.com' --instruction 'Extract job title and company'

Detailed references

• CLI command examples & MCP calling: See references/cli-reference.md
• Workflow patterns (domain resolution, company research, search+qualify): See references/workflow-patterns.md
• Domain resolution decision tree: See references/domain-resolution.md

Key constraints

• enrich_people / enrich_organization: max 10 per call; split larger lists into batches
• find_people / find_organizations: paginated — use --page for more results
• web_search caches page content; if a result has has_content: true, calling web_fetch on that URL is instant
• Seniority levels: owner, founder, c_suite, partner, vp, head, director, manager, senior, entry, intern
• For people enrichment, providing domain (company domain) alongside name greatly improves match accuracy
• CLI output is JSON on stdout, status messages on stderr — parse stdout for data