Security audit
Idea Vault
Security checks across malware telemetry and agentic risk
Overview
The skill mostly matches its local idea-vault purpose, but it deserves review because it can optionally use a yt-dlp cookies file and makes network calls while saving chat-derived content.
Install only if you are comfortable with a local vault retaining saved chat notes and with disclosed calls to YouTube, TranscriptAPI, and captured URLs. Be especially careful with `IDEA_VAULT_YTDLP_COOKIES`: leave it unset unless needed, and never point it at broad browser session data without understanding the consequences.
VirusTotal
64/64 vendors flagged this skill as clean.
Static analysis
No suspicious patterns detected.