Security and Data - The shortest path from a sales task to a first result

Four-state runbook

State	Operator action	Success signal	Do not assume
Copy	`npx -y @okki-global/okki-go-taroball`	The exact command is present in the clipboard.	Copying does not execute or install a package.
Run	Review package identity and execute it in the terminal associated with the intended agent runtime.	The runtime reports completion without an unresolved package or permission error.	A successful process does not prove that every connector is configured.
Configure	Place provider keys in the runtime secret manager, grant only required scopes, and select an approved output.	A small diagnostic task can reach the chosen source without exposing a key in prompts or logs.	Connectivity does not establish data freshness, lawful use, or deliverability.
First result	Ask for one known company and role, then inspect candidates, provenance, checked time, and uncertainty.	The result distinguishes found, inferred, verified, rejected, catch-all, and unknown states.	A verification label never guarantees inbox placement or recipient relevance.

Before you connect a live workflow

Runtime: confirm supported Node.js behavior, package version, update path, uninstall path, subprocesses, network calls, and files created in your chosen environment.
Secrets: store API keys outside prompts and source files. Inspect scope, rotation, revocation, logging, and which operator can retrieve or change each credential.
Email evidence: keep the company and role input, source provenance, retrieval time, DNS or MX observations, mailbox response, and any inference method beside the candidate.
Unknown states: preserve catch-all, greylisting, provider rate limits, temporary failures, and conflicting waterfall enrichment responses instead of converting ambiguity into a confident pass.
Human review: require an operator to assess ICP fit, role relevance, suppression, regional requirements, opt-out handling, and sender-domain readiness before export or outreach.
Downstream data: map every copy written to local files, CRM records, sales-engagement tools, provider logs, or agent memory. Uninstalling the skill does not automatically remove those copies.

A practical acceptance test uses a labeled sample containing valid, invalid, catch-all, and deliberately ambiguous addresses. Record the configuration and test date, then measure outcomes in your own environment. Do not infer database coverage, refresh cadence, match rate, bounce rate, or inbox placement from a single successful lookup.

Start with one controlled task

Copy the installer, review what it will run, configure least privilege, and inspect the first result before expanding the workflow.

npx -y @okki-global/okki-go-taroball