Memoria

This tool implements a local-first memory vault with optional two-way Notion sync and appears to be a legitimate project, but there are important caveats: - The agent instructions explicitly recommend proactively saving personal information (names, location, health) and even 'credentials context'. If Notion sync is configured those entries will be pushed to Notion — consider whether you want sensitive data stored in a third-party workspace. - The Notion integration token is accepted via CLI and then written to the vault config file in plaintext (.memoria.json). Treat that token like any secret; only configure Notion on machines and in workspaces you trust. - Registry metadata says 'instruction-only' but the package contains a full npm CLI. Ask the publisher to clarify distribution/install expectations and confirm the published package name/registry. - If you plan to use this with an agent that autonomously follows the 'proactive capture' guidance, limit its scope or disable auto-sync until you review what it will store and push. Before installing: verify the npm package source (author, repository), consider running it in a restricted environment, and avoid configuring Notion with a token that has access to sensitive data or that you cannot revoke. If you want, I can list the files that store tokens or show where the token is saved so you can audit or modify that behavior.