Customer Persona

v0.1.5

Research-backed customer persona creation with market data and avatar generation. Covers demographics, psychographics, jobs-to-be-done, journey mapping, and...

0· 877·6 current·6 all-time
byÖmer Karışman@okaris
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (customer persona creation + avatar generation) matches the runtime instructions: the SKILL.md consistently instructs use of the inference.sh CLI to run market-research apps and an image model. No unrelated services, binaries, or credentials are requested in the manifest.
Instruction Scope
Instructions stick to persona research steps (market queries, pain points, psychographics) and image avatar generation. However, the document tells the user/agent to run 'curl -fsSL https://cli.inference.sh | sh' and to run 'infsh login' — the latter implies creating/storing service credentials/tokens even though the skill manifest declares no required credentials. The SKILL.md does not instruct the agent to read local files or other unrelated system state.
!
Install Mechanism
No install spec in the manifest, but SKILL.md recommends piping a script from https://cli.inference.sh into sh. The text claims the installer downloads binaries from dist.inference.sh and verifies SHA-256 checksums via a checksums.txt URL. dist.inference.sh/cli is not a widely-known release host like GitHub Releases; 'curl | sh' is a high-risk pattern unless you verify checksums and inspect the script. The skill does attempt to document verification, but the installer and distribution are external and not automatically validated by the platform.
Credentials
The manifest declares no required env vars or credentials, which superficially limits risk. In practice the instructions require 'infsh login' and will call external services (search assistants, image models) that need accounts or API tokens; these credentials are not declared in the skill metadata. That mismatch means the agent will request or create tokens at runtime, and those tokens could allow the external CLI to access or transmit your prompts/data.
Persistence & Privilege
always is false and the skill is user-invocable only. The skill does not request permanent presence or ask to modify other skill/system configs. The primary risk here is remote execution and credential storage by the external CLI, not elevated platform privileges from the skill manifest.
What to consider before installing
This skill appears to do what it claims (research + avatar generation), but exercise caution before following its install instructions. Key points: - The SKILL.md recommends running a remote installer via 'curl | sh' from cli.inference.sh and downloading binaries from dist.inference.sh. 'curl | sh' runs code fetched from the network with no local preview — only proceed if you manually inspect the installer script and verify the checksums yourself. - The manifest lists no required credentials, but the instructions call 'infsh login' and invoke external services (search assistants, image models). Expect to create or provide service tokens; review the CLI's privacy/security docs to understand what data the service logs or retains. - Image generation prompts and market queries will be sent to external providers. Avoid sending sensitive or proprietary information in prompts. - If you want lower risk: install the CLI from a well-known package/release (or from a GitHub release you can verify), or run the recommended commands in an isolated environment (sandbox or container) so the downloaded binary cannot access your wider system or secrets. If you want me to: I can (1) fetch and show the installer script and checksums URL so you can inspect them, (2) point out what permissions 'infsh login' appears to request, or (3) suggest a safer workflow that uses only well-known, auditable tools. Confidence in this assessment is medium because the skill is instruction-only and the external CLI is the main unknown factor.

Like a lobster shell, security has layers — review code before you run it.

latestvk978pfzanna71k54e3g359zv4x81cbmt

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Comments