Nex Life Logger

• Risk level: Low
• Analyzed: Apr 29, 2026, 12:48 PM
• Findings: 0
• Version: 1.1.0

Overview

The skill's code, instructions, and requirements are consistent with a local activity-tracking tool that installs a user-level background collector and offers optional LLM features; nothing in the bundle looks intentionally deceptive, but it is privacy-sensitive and installs a persistent service when you run setup.sh.

This package appears to be what it says: a local activity logger that collects browser history, active windows, and YouTube transcripts and stores them in ~/.life-logger. Before installing or running setup.sh: 1) Review setup.sh and the generated systemd/LaunchAgent file — setup.sh will create a per-user service and start it automatically. 2) Inspect collector_headless.py and summarizer.py (LLM code) if you want to be sure no unexpected endpoints are contacted; transcripts are fetched from YouTube by default. 3) If you do not want network requests, set FETCH_TRANSCRIPTS = False in lib/config.py and do not configure an LLM provider (do not run config set-api-key). 4) Be aware data is stored locally in ~/.life-logger; exports (JSON/CSV/HTML) create files containing sensitive history — protect or delete them. 5) The secure_key fallback may store your API key in a base64 file protected by file permissions; if you rely on strong OS credential stores, verify that those code paths run on your OS. 6) If you have any concerns about persistent collectors, run the collector once (collector_headless.py --once) for testing rather than enabling the service, and audit the service entry before enabling. If you want higher assurance, request the missing code portions (summarizer/export network calls) or run the code in a controlled environment first.