yc

CLI for YC Startup School, a16z Speedrun, SPC, and startup program discovery — weekly updates, dashboard, applications, accelerator deadlines

This package appears to do what it claims, but it accesses sensitive browser session cookies (and thus may act with your logged-in identity on startupschool.org) and its installer writes to your home directory and patches installed package files. Before installing: 1) Verify the package source (check the GitHub repo linked in SKILL.md and confirm the author/trustworthiness); 2) Expect macOS Keychain prompts to decrypt Chrome cookies — only allow if you trust the tool; 3) Be aware the postinstall will create ~/.claude/skills/yc-cli (so it integrates with local AI agent tooling) and will attempt to patch node_modules/@steipete/sweet-cookie; if you prefer, inspect or run the postinstall script manually and perform symlink or patches yourself instead of allowing automatic postinstall; 4) Playwright may download browser engines during install (large files) — consider installing in a controlled environment or container if you want to limit persistent changes; 5) If you are unsure, audit the repository source code and run the CLI in an isolated VM or container rather than on a primary workstation.

Type: OpenClaw Skill Name: yc Version: 0.3.2 The skill bundle provides automation for YC Startup School and other startup applications, but it employs several high-risk behaviors. It extracts sensitive session cookies from multiple browsers (Chrome, Safari, Firefox) via the `@steipete/sweet-cookie` library in `src/lib/cookies.ts` and uses Playwright for browser automation in `src/lib/spc.ts`. Most notably, `scripts/postinstall.js` performs on-the-fly patching of its dependencies within `node_modules` to modify internal timeouts and SQL queries. While these capabilities are aligned with the tool's stated purpose of automating web-based forms and updates, the combination of credential access and self-modifying installation logic warrants a suspicious classification.