People Strategy

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a coherent local contact-graph skill, but it stores personal relationship data persistently and includes local delete/export features users should handle carefully.

This skill looks purpose-aligned and locally scoped. Before installing, be aware that it can build a persistent database of people, relationships, notes, and character descriptions; treat that database and any JSON exports as private, and confirm before deleting or exporting records.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Contact details, relationship context, and private notes may remain on disk and may later be retrieved into agent context.

Why it was flagged

The skill stores a persistent local database of personal and professional relationship data, including free-form notes and character descriptions.

Skill content
persistent graph-based storage using SQLite database ... name, role, relation, organization, character, notes
Recommendation

Use this only for data you are comfortable storing locally, keep the database file private, and review exported graph data before sharing it.

What this means

If used carelessly, the agent or user could overwrite, delete, or expose the local contact graph.

Why it was flagged

The skill exposes local mutation, deletion, and complete export operations for the people graph. These are expected for a CRM-style tool but can affect persistent user data.

Skill content
Update People: Modify any person's information ... Delete People: Remove people from the database ... Full Graph Export: Export entire network as JSON
Recommendation

Confirm destructive changes before running them, keep backups of important databases, and inspect full-graph exports before sending them elsewhere.

What this means

Users have less external context for who maintains the skill or where to verify updates.

Why it was flagged

The registry metadata does not provide an upstream source or homepage, which limits independent provenance review even though the included requirements show no external dependencies.

Skill content
Source: unknown; Homepage: none
Recommendation

Review the included files before installing and prefer trusted publishers or repositories when handling sensitive personal data.