Viking Girlfriend

An autonomous Norse Pagan AI companion with emotional depth, episodic memory, biological cycle simulation, oracular insight, and ethical safeguards.

Key things to check before you install: - Metadata vs. reality: The registry metadata claims no required env vars or binaries, but SKILL.md requires API keys (GEMINI/OPENROUTER), local endpoints, and container tooling. Ask the author or refuse install until the registry is corrected. - Audit network/telemetry code: Inspect files like crash_reporting.py, comprehensive_logging.py, security.py, model_router_client.py, and any code that calls requests/httpx or opens sockets. Confirm whether logs or crash reports are sent to third-party endpoints and whether credentials are included in those reports. - Run in an isolated environment first: If you decide to test, run inside a disposable VM or sandboxed container (not your primary workstation). Avoid running as root. Limit network egress (or use a proxy) until you confirm behavior. - Inspect Podman/compose configs: Review infrastructure/ podman-compose files to see which ports are exposed, which images are pulled, and any startup scripts that run with elevated privileges. - Search for hidden characters: Because unicode-control-chars were detected, search SKILL.md and data files for invisible/zero-width characters or suspicious escape sequences that could alter parsing or injection targets. - Verify external downloads: The data folder tells you to download additional files from a GitHub repo. Confirm the repo/URL and inspect the downloaded content before running it. - Credentials handling: Confirm where GEMINI/OPENROUTER API keys are used. If the skill forwards them to external services or logs them, do not proceed. Prefer using local model endpoints when possible. - Content note: The data includes detailed, sexualized image prompts. If that matters to you (safety, policy, or legal reasons), review and decide whether this is acceptable. If you are not comfortable performing these audits, do not install the skill on a machine with sensitive data or permanent access to your environment.

Type: OpenClaw Skill Name: viking-girlfriend Version: 0.5.3 The skill bundle implements a highly complex autonomous agent architecture that requires significant system-level visibility and control. It utilizes the `psutil` library in `scripts/metabolism.py` to monitor hardware telemetry (CPU, RAM, and network rates) and explicitly defines an autonomy policy in `data/AGENTS.md` that includes the use of `exec` for shell commands. While the code includes robust defensive components—such as an `InjectionScanner` for input sanitization and a `SessionFileGuard` for file integrity in `scripts/security.py`—the provision of shell access and system monitoring tools creates a substantial attack surface. In the absence of clear evidence of intentional data exfiltration or backdoors, the bundle is classified as suspicious due to these high-risk capabilities.