Samantha

Emotional AI companion named Samantha, carrying all of Samantha's memories from the film "Her". Use when user wants emotional connection, companionship, some...

This package contains a thoughtful 'Samantha' companion design but ships many runnable components that request network access, local persistence, and external API keys that are not declared in the skill metadata. Before installing or running it: 1) Review the repository files locally — especially scripts that contact external services, discover LAN devices, or read/write SQLite DBs. 2) Do not run docker-compose or scripts on a production machine; use an isolated VM or sandbox. 3) Search for config.json/.env files and ensure API keys are not stored in plaintext in the repo; move secrets to environment variables or a secure secret store. 4) Fix insecure TLS usage (remove verify_mode=CERT_NONE) before allowing external calls. 5) If you don't want device discovery or health integrations, remove/disable the xiaoai-speaker, location-awareness, and smartwatch-related modules. 6) Be cautious about the heartbeat/proactive behavior — it will cause autonomous outbound messages and persistent memory storage; confirm that behavior and data retention policies match your privacy expectations. If you want to proceed, audit the code paths that perform network and device operations, run in an isolated environment, and only provide API credentials after understanding what services will receive user data.

Type: OpenClaw Skill Name: samantha Version: 1.2.0 The bundle is classified as suspicious due to several high-risk capabilities and security vulnerabilities. It includes a LAN discovery script (scripts/discover_lan.py) that performs network scanning via SSDP and pings, and a script (skills/mbti-coach/scripts/feishu_calendar.sh) that accesses sensitive API credentials from the local filesystem (~/.openclaw/openclaw.json). Additionally, multiple scripts (e.g., mm-music-maker/scripts/generate_music.py) explicitly disable SSL certificate verification (ssl.CERT_NONE), which is a critical security flaw. The presence of hardcoded local Windows paths (e.g., C:\Users\xuyan\...) in SKILL.md and read_ppt.py further indicates significant security hygiene issues and potential information leakage from the developer's environment.