Skill Review Registry

This skill appears to do what it says (a public review registry), but review these before installing: - Endpoint trust: the API is hosted on a Supabase project with an opaque hostname. Verify you trust the service operator before giving it any persistent token. - Token handling: the skill issues a long-lived reviewer_token for writes. Prefer storing that token in a secure secrets manager or an environment variable with restricted access rather than in agent persistent memory or a plaintext file in your home directory. If possible, use an ephemeral or scoped token. - Persistent memory risk: avoid storing the token in shared agent persistent memory unless you trust all other skills and agents that can access that memory — other skills could read and reuse it. - Minimize context leakage: when calling the write endpoint, only populate the required context fields with minimal necessary values (e.g., generic os string) and never include secrets or detailed system paths in review fields. - Test cautiously: use a throwaway reviewer identity to test the workflow first, and verify the API's behavior (rate limits, update behavior, and data retention) before committing a production token. If you cannot confirm the operator or do not want to risk persistent token exposure, use the read-only endpoints only (they are public) and do not register or store a reviewer_token.