Plume NoteCard

This skill appears coherent for generating notecards, but consider these points before installing: - You must supply PLUME_API_KEY: only provide an API key you trust for this service, and avoid using a broadly-scoped secret (use a key limited to the Plume notecard API if possible). - The scripts will read EXTEND.md and may read ~/.openclaw/openclaw.json to find PLUME_API_KEY. If your OpenClaw config contains other secrets, the script reads that file but only attempts to extract PLUME_API_KEY; still, review that file if you are concerned. - The skill writes generated images and action logs into a media directory under your home (or a path set in EXTEND.md). Make sure you’re comfortable with where outputs and logs are stored and their retention. - No remote downloads or 'curl | bash' behavior are present, and the HTTP calls target design.useplume.app by default; if you need to change the API base, review EXTEND.md or set api_base_url explicitly. - If you want extra assurance, inspect the included scripts (already present) or run them in an isolated environment (container or dedicated account) before granting access to sensitive keys. Overall this package is internally consistent with its stated purpose; treat the PLUME_API_KEY with usual caution and confirm the storage locations meet your privacy requirements.