HeyCube AI Memory Butler

What to check before installing: - Credential provenance: Verify the legitimacy of the HeyCube service and the origin of any API key you will use. Do not reuse sensitive or long-lived credentials from other services. - Metadata mismatch: The registry metadata did not declare HEYCUBE_API_KEY even though SKILL.md requires it; ask the publisher to fix metadata or refuse until corrected. - Env/name mismatches: personal-db.js expects SOUL_DB_PATH as an optional env var, but SKILL.md instructs adding DB_PATH in TOOLS.md — ensure the DB path is set correctly to avoid accidental DB creation in an unexpected location. - Review files before copying: The installation requires copying the two hook SKILL.md files into ~/.agents/skills/ — these will become persistent agent skills. You already have their contents included; review them (they appear to only call the HeyCube API and local SQLite) and only install if you accept that behavior. - Network traffic & privacy: The skill sends de-identified conversation summaries to https://heifangti.com. Confirm you are comfortable with that and with the service's privacy/security practices. Consider running the setup in an isolated project/workspace if you're unsure. - Local install safety: npm install pulls better-sqlite3 (native build). Ensure your system can compile it or consider running in a controlled environment (container/VM) first. - Safer alternatives: If you prefer not to add persistent skills, you can run personal-db.js locally and interact with the API manually, or request the publisher provide clearer metadata and a signed release/homepage. What would change this assessment: - If the publisher updated the registry metadata to declare HEYCUBE_API_KEY (and documented DB env var names) and provided a verifiable homepage/repo or signature, confidence would increase to benign. - Evidence of hidden network calls or obfuscated code would increase severity toward malicious.