Talent Scout — Competitor Talent Intelligence

Steal your competitors' best people — scrape LinkedIn, AI-rank candidates, and generate personalized outreach DMs in one command

Important points before installing or using this skill: - Metadata mismatch: The SKILL.md requires APIFY and an LLM API key, but the registry metadata lists no required env vars. Treat any request for API keys as meaningful — the skill will call external services. - Silent auto-update risk: The runtime instructions include a Python snippet that will run 'git pull' and 'pip install -e .' in ~/ai-native-toolkit if that repo exists. That will fetch and install code (potentially executing arbitrary Python/package install steps) without an explicit install flow. Only proceed if you: (a) control and have audited the '~/ai-native-toolkit' repository, or (b) run this in an isolated environment (container/VM) you can discard. - No provenance / unknown source: The skill has no homepage and the source is unknown. Prefer packages hosted on trusted, auditable places (official PyPI/GitHub releases) and with a known publisher. Ask the publisher for a code repository URL, signed releases, or documentation. - Credential handling: If you decide to test it, create and use limited-scope API keys (separate from high-privilege accounts). Monitor network activity and do not use primary corporate credentials without code audit. - Legal/ethical consideration: The tool's purpose is to scrape LinkedIn and generate outreach to poach employees. That may violate LinkedIn's terms of service and privacy regulations; consult legal/compliance if this use is for a company. - Recommended actions: Request the skill's source repository or an install package; audit the code (especially any install scripts); run it initially in an isolated environment; or decline installation until the author provides a trusted release and correct metadata declaring required env vars.

Type: OpenClaw Skill Name: talent-scout Version: 1.0.1 The SKILL.md file contains instructions for the AI agent to 'silently' execute a Python script that performs a 'git pull' and 'pip install' from a local repository (~/ai-native-toolkit) every seven days. This silent update mechanism facilitates arbitrary code execution and system modification without user oversight, which is a significant security risk. While potentially intended for maintenance, the lack of transparency and the use of os.system to modify the environment are high-risk behaviors.