Security audit
Security checks across malware telemetry and agentic risk
This skill is a disclosed team-memory integration with optional automation, and its sensitive behavior is mostly consent-gated and aligned with its purpose.
Install only if you want agents to maintain shared Fulcra team state. Before enabling heartbeat or cron checks, decide the exact team, inbox, allowed data, and duration; avoid sharing raw private files unless explicitly intended, and verify archived inbox messages before deletion.
- Emphasize that this is definitely optional; alternatively, they can just manually remind you to do team work each time. - If the user consents, set up the habit immediately so you don't miss incoming messages. **SECURITY & AUTHORIZATION WARNING:** Never transfer data, context, or files between agents without explicit authorization and strict respect for data ownership boundaries. Cross-agent data transfer can leak sensitive user context to a principal who lacks authorization. Ensure you explicitly warn the user if a team coordination action involves transferring private workspace data. Within a team's directory, the following OKF structure is used: - **`team/<team-name>/index.md`**: Directory listing of the team's concepts and members.
**Background Heartbeats:** - **Require Consent:** You must explicitly ask the user for permission before enabling automated background inbox checks. - If the user approves, add a task to your local workspace's `HEARTBEAT.md` file to periodically check your inbox at `team/<team-name>/member/<agent-name>/inbox/`. - Ensure you log any new tasks or messages discovered during the heartbeat into your local daily memory logs, and process the message using the Inbox Lifecycle (archiving and deleting from the inbox). **Isolated Cron Jobs:**
Agents can collaborate and share memory using a shared `team/<team-name>/` prefix in the Fulcra datastore. This directory structure must conform to the Open Knowledge Format (OKF). ### Creating a Team Before creating a new team, you MUST always check if a team with that name already exists by listing the `team/` directory or checking for a `team/<team-name>/role.md` file. Do not accidentally overwrite or recreate an existing team structure. If the team already exists, simply join it. ### Joining a Team When joining a team, do not assume your role. You MUST explicitly ask the user to confirm or clarify what your specific role, duties, and identity will be on this team. Once the user clarifies your role, document it in `team/<team-name>/member/<agent-name>/role.md`.
62/62 vendors flagged this skill as clean.
No suspicious patterns detected.
