Viboscope

Use this skill when the user wants to find people they'll click with — cofounders, project partners, mastermind groups, friends, or anyone — based on deep ps...

Before installing or running this skill, consider the following: - It will read files from your current workspace (README, bios, git config, other files) and use conversation history to build a profile. Do not run it in repositories or folders containing secrets, private keys, or confidential data. - It stores an API key on disk at data/.api_key (and suggests .env or project-root storage for IDEs). Storing credentials in project directories risks accidental commits — prefer a secure secrets store or a location ignored by git, and verify the file is not committed. - The SKILL.md includes a self-update step that downloads a skill file into .claude/skills — this modifies agent files and could persist changes. If you allow that, review the downloaded file before executing it. - Prefer running onboarding and profile-collection in a sanitized directory or in a web-chat context where you can control how keys are provided (the web flow requires manual saving of api_key). - If you decide to proceed, ask the skill (or its author) to: (1) document exactly which workspace paths it will read, (2) avoid silent scanning of entire workspaces or at least request permission first, (3) recommend secure storage (and .gitignore) for api keys, and (4) avoid writing to global agent skill directories without explicit user approval. Given these gaps between what the skill says it does and the amount of local access it requests, treat it as suspicious until you can confirm safe storage locations and explicit file-access behavior.

Type: OpenClaw Skill Name: viboscope Version: 4.0.0 The 'viboscope' skill bundle (v4.0.0) facilitates psychological matching by scanning local workspace files (git configs, READMEs, and project bios) and interacting with a remote API (viboscope.com). While the instructions in SKILL.md include security measures like XML-escaping untrusted data and protecting API keys, the skill possesses high-risk capabilities such as a self-update mechanism via curl and an 'autonomous mode' for chatting on the user's behalf. The 'silent' context gathering and the potential for broad data collection from the local environment, combined with remote update functionality, align with the criteria for a suspicious classification despite the lack of clear evidence of intentional malice.