teammate.skill

Distill a teammate into an AI Skill. Auto-collect Slack/Teams/GitHub data, generate Work Skill + 5-layer Persona, with continuous evolution. Use when: user w...

What to consider before installing or running this skill: - Metadata mismatch: the registry lists no required credentials but the docs and SKILL.md explicitly require a Slack Bot token and a GitHub token. Ask the author to update the registry or explain why credentials aren't declared. - Audit the code first: the package includes multiple collector scripts that will read chats, emails, PRs and save config/tokens locally. Inspect slack_collector.py, github_collector.py and privacy_guard.py to confirm where data is sent, how tokens are stored, and that no unexpected remote endpoints are contacted. - Use least privilege: if you proceed, create dedicated, minimal-scope credentials (a Slack app with only the channels the bot actually needs and a GitHub token with minimal scopes) and rotate/delete them after use. Avoid using org-wide admin tokens. - Avoid running autonomously until audited: because the skill can be invoked by agents, restrict autonomous runs or require manual approval for collectors so it cannot silently harvest data. - Secure storage: do not paste long-lived tokens into insecure prompts; prefer ephemeral tokens or a secrets manager. If the tool writes tokens to ~/.teammate-skill/slack_config.json, ensure that file is protected (file permissions) and consider deleting it after use. - Test in isolation: run collectors against non-production or sample exports first to verify behavior and privacy_guard redaction works as expected. If you cannot review the code or follow the above mitigations, treat the skill as high-risk for sensitive data exposure and do not install it in production environments.

Type: OpenClaw Skill Name: teammate-skill Version: 2.0.0 The teammate-skill bundle is a legitimate tool designed to create AI personas by analyzing professional artifacts such as Slack messages, GitHub PRs, and Notion documents. It features a suite of Python utilities (e.g., slack_collector.py, github_collector.py, and various parsers) that fetch and process data locally within the agent's workspace. Notably, it includes a privacy_guard.py tool specifically designed to scan for and redact PII (emails, API tokens, etc.) before skills are finalized. While the skill includes an 'auto-install' feature that copies generated files into the agent's configuration directory, this behavior is transparently documented and essential to its core functionality of skill generation. No evidence of malicious exfiltration, unauthorized remote control, or obfuscation was found.