people-search

Search, qualify, and enrich people and companies. Use this skill whenever the user wants to find professionals, candidates, or KOLs by title, company, locati...

This skill appears to be a wrapper for the Lessie people-search service and mostly behaves as expected, but pay attention to these practical risks before installing or letting the agent run it automatically: - Installation and execution: The SKILL.md tells the agent to auto-install the Lessie CLI via npm/npx if not found. npm/npx will fetch and run code from the public registry — prefer to install the CLI yourself manually (verify package identity and versions) rather than allowing an agent to run npm install -g automatically. - Authentication and tokens: Authorization uses a browser flow and caches a token at ~/.lessie/oauth.json. Be aware an OAuth token stored in your home directory will be used for subsequent calls and may allow the Lessie server to access queries and results. If you want to control token location or lifetime, perform auth yourself and inspect ~/.lessie/oauth.json. - MCP config edits & remote MCP server: The skill encourages adding a Lessie MCP entry to other tools' MCP config files (e.g., ~/.claude/mcp.json) and running an MCP server that connects to https://app.lessie.ai. Editing other clients' config or running a background MCP server gives a remote service broader access and can be surprising—only do this if you trust Lessie and have reviewed the URL and package sources. - Auto-activation scope: The skill is meant to trigger on generic mentions of 'finding people' or 'sourcing' and may attempt network actions. If you prefer tight control, require explicit user consent before installing or invoking the skill. - Data & compliance: The skill will send search queries and profile data to Lessie's service. Make sure this is acceptable for your data sensitivity and legal compliance (GDPR, CAN-SPAM, etc.). - Mitigations: (1) Install the CLI yourself in a controlled environment and vet the npm package; (2) refuse automatic global installs; (3) avoid or review MCP config changes; (4) run the skill in a sandbox or isolated account if you need to test it; (5) read Lessie's privacy policy and terms and confirm the app.lessie.ai domain is legitimate before enabling MCP server. Given these trade-offs, only enable automatic installs or MCP server registration if you trust the Lessie service and are comfortable with tokens and config changes in your user profile.

Type: OpenClaw Skill Name: people-search Version: 1.0.0 The skill bundle for 'Lessie' (a people search service) includes instructions in SKILL.md for the AI agent to automatically perform a global system installation ('npm install -g @lessie/cli') if the tool is not detected. While this is intended to facilitate the skill's functionality, automatic global software installation is a high-risk capability. Additionally, the instructions prompt the agent to activate the skill broadly for any mention of finding contacts, which could lead to unintended credit consumption, although the skill does mandate user confirmation before spending credits.