ZappushZappush
SkillsUse CasesBenchmarkCommunitySign In
      Back to Skills
      living-hi

      Safety Report

      One Person Company OS

      @living-hi

      Build a visual operating cockpit for an AI-native one-person company across promise, buyer, product, delivery, cash, learning, and assets. / 为 AI 一人公司建立可视化经营...

      552Downloads
      0Installs
      1Stars
      25Versions
      E-Commerce4,909Design & Prototyping2,478Education & Learning2,329

      Security Analysis

      high confidence
      Clean0.04 risk

      The package and runtime instructions are consistent with its stated purpose (building a local, founder-approved workspace and operating cockpit); required resources and behaviors are proportional and documented, with no obvious attempt to access unrelated secrets or system components.

      Apr 28, 2026162 files1 concern
      Purpose & Capabilityok

      The name/description match the repository contents: many scripts and templates exist to generate a localized operating cockpit, SVG visuals, markdown/DOCX outputs, and a hidden machine state. Platform adapter wrappers and a local MCP stdio server are present to enable integration but are described in changelogs and publishing docs, which is consistent with a multi-adapter distribution package.

      Instruction Scopeok

      SKILL.md limits runtime actions to: (1) run bundled Python scripts with an existing Python 3.7+, (2) create files only inside a founder-approved workspace, and (3) avoid auto-installing system packages or requesting unrelated credentials. Recommended commands and the README follow that scope. There are no instructions in SKILL.md that ask the agent to read unrelated host files or exfiltrate secrets.

      Install Mechanismok

      No install spec is declared (instruction-only at marketplace level). The package contains many scripts and platform adapters but does not prescribe downloading or extracting remote binaries. This is proportionate for a repository intended to be run locally after review.

      Credentialsnote

      The skill declares no required environment variables or credentials for normal operation, which aligns with SKILL.md claims. However, the repository contains platform adapters (Claude, Dify, OpenAI, Dify plugin provider, MCP server, etc.). Those adapters may require platform-specific API keys or host configuration when used — but they are optional runtime paths and the package does not force them. Users should expect that enabling platform-specific adapters will require supplying the appropriate credentials at that time.

      Persistence & Privilegeok

      The package writes files to a local workspace (explicitly constrained by the SKILL.md and scripts). always:false and model invocation enabled are appropriate. The package includes a local MCP stdio server (platforms/mcp-server/server.py) that exposes script entrypoints to local clients; this is consistent with a local integration adapter but means the host may run a listening process if you start it.

      Guidance

      This package appears coherent with its purpose, but review and basic precautions are recommended before running: 1) Inspect scripts/ensure_python_runtime.py, platforms/mcp-server/server.py, and platform adapter files (platforms/dify-plugin/provider/one_person_company_os.py) to confirm you understand any network/listening behavior. 2) Run the scripts only in an isolated or empty folder (or container/VM) until you confirm outputs are safe and confined to the approved workspace path. 3) The repository includes optional platform adapters — only provide API keys or enable adapters if you intend to publish or connect to external services. 4) If you plan to run the MCP server, be aware it can open a local endpoint; bind it appropriately and avoid exposing it to untrusted networks. 5) If you want extra assurance, run python3 -m pip check / static linters or open the code for a short review of I/O and subprocess usage before executing.

      Latest Release

      v1.0.2

      Add multi-platform adapters for Claude Skills, Hermes Agent, MCP clients, OpenAI GPT Store, Dify, Poe, Gemini Gems, GitHub Copilot Extensions, and Microsoft Copilot Studio.

      Popular Skills

      SMS Best Practices

      @sendly-live · 0 stars

      Verifying Phones

      @sendly-live · 0 stars

      Ldm Openclaw Skill

      @live-direct-marketing · 0 stars

      Sending SMS

      @sendly-live · 0 stars

      Ldm Openclaw Inbox Mcp Skill

      @live-direct-marketing · 0 stars

      self-improving-agent

      @pskoett · 1,456 stars

      Published by @living-hi on ClawHub

      Zappush© 2026 Zappush
      HomeGuaranteeSupport

      Something feels unusual? We want to help: [email protected]