OPC Framework

OPC (One-Person Company) Framework - Complete AI agent system for solo entrepreneurs with 14 integrated skills. From ideation to deployment - creative planni...

This package is an instruction-only framework and appears coherent with its stated purpose. Before installing or running it, consider the following: - The skill itself does not require keys or install anything, but many subskills recommend connecting third-party services (Supabase, Firebase, Zapier/Make, Sentry, Buffer, Cloudflare, payment platforms). Only provide API keys or webhook access to those services when you intentionally enable a particular integration and trust the recipient. - Review which subskills you plan to use. If you only need ideation and PRD writing, you can ignore the deployment/ops recommendations that imply infrastructure changes. - The framework suggests actions that may cause external network activity (domain checks, social listening, publishing to social platforms, automated replies). Treat those as user-driven choices and verify any automation you configure sends data only to destinations you approve. - Because this is instruction-only text, it cannot autonomously exfiltrate secrets from your environment without you wiring it to external services. Still, be cautious when granting it downstream permissions (webhooks, Zapier, Slack tokens, cloud provider keys). If you want deeper assurance, ask the skill author for a minimal manifest of which subskills perform network calls and a list of exact endpoints they will contact when enabled.

Type: OpenClaw Skill Name: opc Version: 1.0.0 The skill bundle is classified as suspicious due to the inherent high-risk nature of operations described in several skills, particularly 'deployment' and 'operations'. The `deployment/SKILL_EN.md` and `deployment/SKILL_ZH.md` files instruct the AI agent to perform actions like 'DB Migration', 'Service Deployment', 'Config Update', and 'Backup of production database'. Similarly, `operations/SKILL_EN.md` and `operations/SKILL_ZH.md` describe 'Automated Operations' (e.g., auto-publishing, handling sales, auto-replies, aggregating notifications) and 'Monitor cloud costs, shut down idle resources'. While these capabilities are plausibly needed for the stated purpose of managing a 'One-Person Company', they imply the agent would require significant permissions (e.g., database access, cloud API access, system-level control) to execute. This represents a substantial attack surface and potential for critical vulnerabilities if the AI agent's execution environment is not securely sandboxed, even though there is no clear evidence of intentional malicious behavior instructed by the skill bundle itself.