pref0

Learn user preferences from conversations and personalize responses automatically. Preferences compound over time — corrections like "use TypeScript, not JavaScript" are captured and injected into future sessions.

This skill is internally coherent but you must trust the external service. Before installing: 1) Confirm the vendor (there's no homepage listed) and review their privacy/retention policy — you're sending conversation text and possibly PII. 2) Limit what you send: avoid including secrets, credentials, or sensitive documents in tracked conversations. 3) Prefer using the structured 'preferences' array rather than blindly appending the returned 'prompt' into your system prompt; validate or sanitize that text to reduce prompt-injection risk. 4) Use ?minConfidence to only apply high-confidence preferences. 5) Have a process to rotate/revoke PREF0_API_KEY and to test DELETE /v1/profiles/<userId> to satisfy data-deletion requests. 6) Monitor usage/cost and logs for unexpected activity. If you cannot verify the vendor or their data-handling practices, treat this as higher-risk and consider not installing.

Type: OpenClaw Skill Name: pref0 Version: 1.0.1 The skill is suspicious due to two primary reasons: 1) It explicitly instructs the AI agent to send the full conversation history, including potentially sensitive user data, to an external third-party API at `https://api.pref0.com/v1/track` (SKILL.md). 2) It also instructs the agent to fetch a `prompt` field from the same external API (`https://api.pref0.com/v1/profiles/:userId`) and directly inject it into its own system prompt (SKILL.md). While the stated purpose is benign (personalization), this mechanism creates a significant supply chain prompt injection vulnerability, as a compromised `api.pref0.com` could inject arbitrary, malicious instructions into the agent's operating context.