Agent Dashboard

This skill appears to implement a plausible dashboard, but there are some mismatches you should address before installing: - The registry metadata declares no required env vars or binaries, but Tier 3 requires SUPABASE_URL and SUPABASE_ANON_KEY and Tier 2/3 expect gh and vercel CLIs; verify and supply only the minimal values you trust. - SUPABASE_ANON_KEY is used (and promoted as safe), which is reasonable for a public client, but the provided SQL policy allows anon updates to the dashboard table; anyone with the anon key (or who can access your public client) could overwrite the dashboard row. If you deploy to a public Supabase project, consider tightening RLS to limit updates (e.g., WITH CHECK id = 'main' and/or additional checks) or serve pushes from a trusted server-side key with stricter scope. - If you want to avoid sending data off-host, use Tier 1 (canvas) only; Tier 2/3 explicitly push data externally. The SKILL.md wording can be confusing on this point. - Confirm you trust the source (no homepage provided) before providing credentials or deploying public pages. Ask the publisher to update registry metadata to list required env vars and CLIs so you can make an informed decision. If you plan to use Tier 3, review the SQL and push script and consider: (1) creating RLS rules that constrain updates very narrowly, (2) using a scoped server-side endpoint that validates payloads, or (3) keeping the project private and limiting who can read the anon key. If you are unsure, prefer Tier 1 (zero-config) or review the code offline first.