一套优雅的模块化智能记忆系统，支持 embeddings、reranker 和 Flomo 笔记集成。

• Analyzed: May 11, 2026, 5:39 AM
• Findings: 1
• Version: 0.1.0
• Hash: 4e5dc71a0b580081b2cd1da87b82ce23c2cde9f14f0866d01d400fca616a4955
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill bundle is classified as suspicious primarily due to the inclusion of a hardcoded API key (sk-BrwHc1ZiaEGQ1GecD3D760384b874795A194882c2cF3AbE6) in test-real/real-api-test.js and config/template.json, which represents a significant security vulnerability. Additionally, the 'import-flomo' feature implemented in entry.js and src/adapters/FlomoAdapter.js allows the agent to read arbitrary local files using fs.readFileSync based on user-supplied paths; while this aligns with the stated purpose of importing notes, it creates an attack surface for sensitive data exposure if the agent is targeted by prompt injection. The core functionality relies on external network requests to api.edgefn.net for processing user data.