Security audit
Security checks across malware telemetry and agentic risk
ByteRover is a coherent project-memory skill, but it asks agents to use an LLM-backed memory tool too broadly and can persist or transmit project/user context without tight consent boundaries.
Review before installing. Use ByteRover only for intentional project-memory workflows, prefer local `brv search` when LLM synthesis is unnecessary, avoid storing secrets or personal data, and only connect providers or run cloud sync when you understand what content may be processed or uploaded.
**File access**: The `-f` flag on `brv curate` reads files from the current project directory only. Paths outside the project root are rejected. Maximum 5 files per command, text and document formats only. **LLM usage**: `brv query` and `brv curate` send context to a configured LLM provider for processing. The LLM sees the query or curate text and any included file contents. No data is sent to ByteRover servers unless you explicitly run `brv vc push`. **Cloud sync**: `brv vc push` and `brv vc pull` require authentication (`brv login`) and sync knowledge with ByteRover's cloud service via git. All other commands operate without ByteRover authentication.
64/64 vendors flagged this skill as clean.
No suspicious patterns detected.
