Peeps: Your people, remembered.

Personal network intelligence — remember people, find connections, and draft intros. Contacts stored locally as plain markdown files.

This skill appears to implement what it claims (local contact files and intro drafting) but has several privacy and coherence issues to consider before installing: - Verify the source: README provides a GitHub raw URL and repo name but registry metadata lists no source. Do NOT run curl/npm commands until you confirm the canonical repository and review its contents. - Backup data: the skill will read and write files under mind/peeps/ and its housekeeping rules delete/move entries automatically. Back up that folder before enabling the skill. - Silent cleanup: the SKILL.md requires silent deletion/moving of items on every read (3/7/10-day windows). If you want to keep historical records, change or disable that behavior. - Web searches & images: it instructs the agent to "search the web" and optionally fetch headshots — this will cause external network requests that may expose names and context to third-party services. If you need stricter privacy, disable web lookups or set images: no in peepsconfig.yml. - Cross-skill dispatch: it can dispatch to Haah or write to Pages/Vibes/Digs if installed; review those skills' behavior because they may broadcast queries outside your local machine. - Least privilege: prefer running this skill only when explicitly invoked (avoid enabling broad autonomous invocation), and test it in a contained workspace first. If the publisher can confirm a maintained public repo (so you can review exact SKILL.md history) and you modify or disable the silent cleanup and external-search behaviors, my concerns would be reduced.

Type: OpenClaw Skill Name: peeps Version: 1.0.2 The 'peeps' skill manages personal networking data via local Markdown files but contains high-risk instructions for the AI agent. Specifically, SKILL.md directs the agent to dynamically construct and execute bash scripts for batching 'grep' operations, which creates a significant shell injection surface if user-provided search terms are not sanitized. Additionally, the skill performs 'silent' file deletions for housekeeping and suggests creating cron jobs for background 'heartbeat' checks, which are sensitive operations that lack transparency.