ddday

This skill appears to do what it says (scanning projects and building migration bundles) but has important privacy risks by default. Before installing or running it: 1) Only register explicit project paths — never add home (~/) or root, or entire disks. 2) Review workspace.json after adding projects to ensure paths are correct. 3) Expect the export/snapshot to include everything in each registered project directory; explicitly exclude directories or file patterns that contain secrets (e.g., .env, credentials, private keys, build artifacts). 4) Inspect any generated bundle before transferring it off-device. 5) Don't enable the optional cron until you have a reviewed generate_dashboard.py script in place and are confident about what gets collected. 6) If you need assurance the skill won't collect agent memory or other sensitive config, ask the author (or review the missing Mode 4 export details) — the truncated instructions make it unclear whether 'AI memory' or other agent files are collected. Additional information that would change this assessment: the full Mode 4 export procedure, explicit exclusion rules for secrets, and confirmation that no network upload of bundles occurs.