Engram

This skill appears to be a local-first memory layer and its commands/instructions align with that goal, but take these precautions before installing or enabling it: 1) Verify the provenance of the 'engram-memory' npm package (author, repository, checksum) and only install from a trusted source. 2) Be cautious about the SKILL.md 'MANDATORY' boot step — it instructs the agent to run an automatic search using the current task context on every session start; disable or modify this behavior if you do not want context automatically sent to the memory service. 3) Assume the system will persist anything you add (the docs explicitly mention storing 'credentials'); never ingest secrets or sensitive tokens unless you have encryption/audit controls and isolation in place. 4) Secure the local server/dashboard (localhost is safer than public host, but ensure it's bound to localhost only and access is restricted). 5) Consider using explicit retention/decay/deduplication settings and enable export/encryption of backups before allowing automated ingestion. 6) If you need higher assurance, request the upstream source code or a vetted package repository and a privacy/security whitepaper from the author; absence of a homepage/repository is a red flag. 7) If unsure, classify this as high-risk for sensitive contexts and run only in an isolated environment or container.