Personaldatahub

Pull personal data (emails, issues) and propose outbound actions (drafts, replies) through the PersonalDataHub access control gateway. Data is filtered, reda...

What to consider before installing this skill: - Confirm source and trust: The skill's homepage points to a GitHub repo; review that repo and its history before installing. The package will build and may start a local server and create local credentials. - Expect writes and processes: The SKILL.md install steps run pnpm build and npx pdh init/start, which will write config and credentials under ~/.pdh and start a background HTTP service on localhost. If you do not want services started or files written to your home directory, do not run the install commands. - Environment/credentials mismatch: Although the registry lists no required env vars, the code reads PDH_HUB_URL and PDH_API_KEY and ~/.pdh/credentials.json. If you install, verify where API keys and hub URLs are stored and who can read them. - Secret leakage risk: The plugin logs auto-created API keys (api.logger.info). If you allow auto-creation, the key may be emitted to agent logs. Consider rotating/deleting any auto-created key or inspecting logs for exposure. - Install in a sandbox first: Because the install uses pnpm at a parent path (cd ../../) and starts a server, run the install and server inside a container, VM, or isolated environment to confirm behavior before adding it to a production/local agent. - Verify 'cd ../../' intent: The install line's cd ../../ is unusual (it moves out of the plugin directory) — ask the author why this is necessary and whether the command should be run from a particular repository layout. - Prefer explicit configuration: Instead of relying on auto-discovery/auto-creation, consider configuring hubUrl and apiKey explicitly (or set environment variables) so you control where credentials are created and stored. If you want more assurance, ask the maintainer for a detailed install guide, a signed release, or run a code review of the npx pdh package and the repo's build artifacts before enabling the skill in your agent.

Type: OpenClaw Skill Name: personaldatahub Version: 0.1.0 The skill is classified as suspicious due to significant discrepancies between the provided `src` (source) and `dist` (compiled) files, particularly concerning API key handling and configuration loading (`src/hub-client.ts` vs `dist/hub-client.js`, `src/index.ts` vs `dist/index.js`, `src/setup.ts` vs `dist/setup.js`). While the `dist` code (which would be executed) appears to implement the stated functionality of interacting with a local PersonalDataHub and includes security features like API key authentication and owner approval for actions, the lack of transparency and reproducibility between `src` and `dist` is a critical supply chain vulnerability. Additionally, the `SKILL.md`'s `install` command includes `cd ../../`, which is an overly broad directory change that could lead to unintended side effects during installation, although the subsequent commands (`pnpm install`, `npx pdh init`, `npx pdh start`) are specific to the stated purpose.