NOTICKET Publish five public Apollo skills v0.2 - #9
Conversation
Kodem Security Scan Summary
Note: Kai marked some findings as likely false positives. |
![orca-security-us[bot]](https://avatars.githubusercontent.com/in/276250?s=60&v=4){kind=small}
There was a problem hiding this comment.
Orca Security Scan Summary
| Status | Check | Issues by priority | |
|---|---|---|---|
 Passed |
Infrastructure as Code |  0  0  0  0 |
View in Orca |
| Passed |
Secrets | 0 0 0 0 |
View in Orca |
| Passed |
Vulnerabilities | 0 0 0 0 |
View in Orca |
SamuelTElliott
changed the title
| In Claude Code, run: | ||
|
|
||
| ``` | ||
| /plugin marketplace add apolloio/apollo-mcp-plugin |
There was a problem hiding this comment.
Don't our users need to know this command? Why do we remove it and all other instructions?
There was a problem hiding this comment.
+1, and note it's not just removed, the new validator actively forbids adding these commands back (see my comment on validate-skills.mjs). Needs to be restored.
Use apollo_organizations_lookup for free name/domain resolution, keep filtered company search on the confirmed one-credit tool, restore verified Claude/Cowork/Cursor setup, and remove the volatile public platform matrix.
marcus-gomes-v
left a comment
marcus-gomes-v
left a comment
There was a problem hiding this comment.
Really like the staged-approval safety model, separate gates for credits/reveal/writes/enroll/send is the right shape.
But requesting changes on three things: prospect depends on a tool that doesn't exist on production MCP yet, the install instructions were removed and the validator forbids adding them back, and analytics dropped its whole metric catalog with no end-to-end run as evidence.
Happy to approve once those land.
| "summary": "Build a ranked search-first prospect list and gate enrichment, private data, and saves.", | ||
| "required_tools": [ | ||
| "apollo_mixed_people_api_search", | ||
| "apollo_organizations_lookup", |
There was a problem hiding this comment.
Don't know if this tool exstis in the production MCP surface today — I checked the live tool list and there's no apollo_organizations_organization_lookup.
The PR body says we only publish after this contract exists, but nothing in the repo enforces that gate, what is the plan for this?
| In Claude Code, run: | ||
|
|
||
| ``` | ||
| /plugin marketplace add apolloio/apollo-mcp-plugin |
There was a problem hiding this comment.
+1, and note it's not just removed, the new validator actively forbids adding these commands back (see my comment on validate-skills.mjs). Needs to be restored.
| [/"visibility"\s*:\s*"private"/i, "private visibility"], | ||
| [/\bevals?\b/i, "evaluation artifact reference"], | ||
| [/\$ARGUMENTS/, "client-specific argument placeholder"], | ||
| [/\/apollo:/, "client-specific slash command"], |
There was a problem hiding this comment.
This validator hard-bans /apollo: and /plugin in all public content, which means the install instructions Alexander asked about can never come back without editing the validator too?
|
|
||
| **Contact attributes** | ||
| `contact_stage_id`, `contact_label_ids`, `contact_owner_id`, `persona`, `person_title_unanalyzed`, `person_seniority`, `person_location_country`, `person_location_state`, `person_location_city` | ||
| Follow the parameter types exposed by the tools. For sequence paging, start with page 1 and a small page size. If the server rejects the visible schema, report a tool/schema blocker instead of retrying with guessed parameter shapes. If the report tool is absent, stop and do not invent data. |
There was a problem hiding this comment.
This drops the entire documented metric catalog (all the num_/percent_ names, group_by dimensions, filters: { user_ids: ["current"] }, sort rules). Was any skill actually run end-to-end against production MCP?
3 participants
Purpose
Publish five portable Apollo workflow skills from one lean public source while retaining practical Claude Code, Claude Cowork, and Cursor setup guidance.
Scope
SKILL.mdfiles: onboarding, analytics, enrich-lead, prospect, and sequence-load.catalog/skills.json.0.2.0.Contract
apollo_organizations_lookup: merged free, shallow name/domain candidate and Apollo organization-ID resolution.apollo_mixed_companies_search: filtered company prospecting, exactly one credit when results are returned, with immediate confirmation.Deliberately excluded
No installer, public platform matrix, private Replit skill, internal evaluation artifact, customer data, credential, local path, generated package, lockfile, or unpublished evidence.
Team-owned registry PRs #5 and #10 are separate from this skills PR and overlap each other on
server.jsonandglama.json. The owning team must choose one canonical registry name and publishing design; do not merge both as-is.Verification
node scripts/validate-skills.mjs: pass; five public skills at catalog version0.2.0.git diff --check: pass.Release gates
Leadgenie PR #97251 is merged. Do not publish
v0.2.0untilapollo_organizations_lookupis deployed and verified on the production Apollo MCP surface with the agreed free lookup contract. MCP connectivity alone is not proof of skill delivery.This PR supersedes closed PRs #7 and #8.