YouOS
v0.1.18YouOS — local-first personal email copilot that learns your writing style from Gmail, Google Docs, and WhatsApp exports, then drafts replies in your voice. U...
⭐ 0· 135·0 current·0 all-time
by@drbaher
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description (personal email copilot) align with what the package requires and does: Python app that ingests Gmail/Google Docs/WhatsApp and builds local indices. Required binaries (python3, gog) and the documented dependency on the gog CLI for Gmail/Docs access are expected and appropriate.
Instruction Scope
SKILL.md and code instruct the agent/user to run local ingestion, build a local SQLite DB, run periodic 'improve' pipelines, and optionally install a background launchd service and a Gmail bookmarklet that injects drafts into the Gmail compose UI. Those are within the stated purpose but warrant caution because they touch user email data and may insert UI elements into Gmail. The SKILL.md explicitly warns about sensitive data ingestion and recommends local-only operation; instructions do not appear to instruct reading unrelated system files or exfiltrating secrets by default.
Install Mechanism
Install is manual via 'pip install -e .' which runs local package install code (SKILL.md warns to review source). No remote download URLs or package-install-from-untrusted-host steps are present in the instructions. One metadata inconsistency: the registry summary initially said 'No install spec — instruction-only skill', but SKILL.md contains explicit install instructions and the bundle includes many source files, so this is not instruction-only—review the supplied source before running pip install.
Credentials
Requested credentials/inputs are proportional: the skill needs the gog CLI authenticated to the user's Gmail/Docs accounts (documented). An optional external model (Claude) credential is only used if the user enables external fallback. There are no unrelated or inexplicably broad environment variables or secret requests declared.
Persistence & Privilege
The skill does not force permanent inclusion (always:false) and can operate locally. However the repository includes scripts to install a launchd background service (install_youos_launchd.sh / run_youos_launchd.sh) and various automation (nightly pipeline). Those are optional and only executed if the user runs them, but they grant persistent background execution when installed—review those scripts before enabling automation.
Assessment
This package largely does what it claims, but take these precautions before installing:
- Review the source before running 'pip install -e .' (that executes package install code locally).
- Confirm you trust the repository: it will ingest sensitive data (Gmail, Docs, WhatsApp) into a local SQLite DB.
- Keep model.fallback set to 'none' if you want strictly local operation; enabling external fallback can send content to third-party model providers.
- Inspect the launchd install scripts and bookmarklet code before running/ installing them—they enable background jobs and inject UI elements into Gmail when activated.
- Ensure the gog CLI you authenticate is the intended account and that you understand what scope/permissions gog grants. If you want stronger assurance, run the app in an isolated environment (dedicated user/VM) and audit outgoing network activity while testing.Like a lobster shell, security has layers — review code before you run it.
ai-assistantvk9720j6hzzq0jb236r4d5pfs9d832d70apple-siliconvk9720j6hzzq0jb236r4d5pfs9d832d70automationvk9720j6hzzq0jb236r4d5pfs9d832d70autoresearchvk9720j6hzzq0jb236r4d5pfs9d832d70emailvk97f5h8qnn0e82fmqcz8tf4h0d832pwmgmailvk97f5h8qnn0e82fmqcz8tf4h0d832pwmlatestvk971csh53a0ny3hd75xeskqqr5836smmlocal-firstvk97f5h8qnn0e82fmqcz8tf4h0d832pwmprivacyvk97f5h8qnn0e82fmqcz8tf4h0d832pwmproductivityvk97f5h8qnn0e82fmqcz8tf4h0d832pwm
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython3, gog