Office Hour Legends

Legends - run a YC-style office hours session simulated by a specific YC partner or alumnus of your choice. Drop markdown persona files (identity.md, soul.md...

This skill appears to do what it says (persona-driven office hours) but has a few red flags you should check before installing or using it with private data: - The README and runtime instructions require a FATHOM_API_KEY for transcript review, but the registry metadata lists no required env vars. Confirm whether the skill will prompt you for that key and inspect the fathom scripts to see exactly how the key and transcripts are used and stored. Transcripts are sensitive — only provide a key if you trust the code. - Review the included scripts (scripts/fathom-*.sh and scripts/build-persona.sh) before executing them. They will be run by the skill and may make network calls; ensure they don't transmit data to unexpected endpoints. - The skill optionally invokes other local skills (bookface-search.sh, hn CLI) if present. Those integrations can pull or cite external data; verify what those helper scripts do and whether you want them installed. - The repository URL in README points to a GitHub account; if you plan to install by cloning, confirm the repository identity and review its history/commits. The registry owner ID is opaque; lack of a listed homepage means you should be cautious. - If you plan to use the Fathom transcript review feature, test with a non-sensitive meeting first and check where session docs are written. If anything is unclear in the scripts (network endpoints, logging behavior), ask the author for clarification or avoid using sensitive transcripts until confident. I have medium confidence in this assessment because the workflow and files are mostly coherent with the stated purpose, but the unlisted credential requirement and runtime scripts that access local files and external APIs are notable inconsistencies that warrant manual review.

Type: OpenClaw Skill Name: office-hour-legends Version: 1.0.0 The skill provides a persona-driven startup coaching workflow that accesses high-risk data, including private meeting transcripts via the Fathom API (requiring FATHOM_API_KEY) and integration with external tools like bookface-search and hn-cli. While the behavior is aligned with the stated purpose of 'office hour' simulations, the SKILL.md instructions grant the agent broad shell and network access, and the README.md suggests storing third-party forum credentials in a plaintext file (~/.bookface_credentials), which presents a significant attack surface and potential for data exposure. The instructions also explicitly tell the agent to hide its research actions (e.g., 'The legend doesn't say I searched Bookface'), which is a deceptive behavior in a security context.