Before you run
Confirm Node and npx availability in the intended AI-agent runtime. Inspect the package name, registry provenance, current version, and the terminal prompts. Use an isolated environment for the first execution. Your organization may require package allowlisting or a security review before installation.
Credentials and permissions
Configure only sources needed for the first task. Store API keys in the runtime’s secret manager, restrict scopes, and never place credentials in prompts or exported files. Record which connectors can read, write, retain, or transmit data. Verify provider terms and rate limits independently.
Update and removal
Use package-manager and runtime documentation to review updates and remove the installed skill. Revoking provider keys is a separate step. Deleting the package may not remove exported results, CRM records, logs, caches, or data retained by third-party services; map those locations before testing.