Security audit
Security checks across malware telemetry and agentic risk
This is a legitimate personalization skill, but it needs Review because it can inspect sensitive local and account data and retain profiling artifacts despite narrower privacy promises.
Install only if you are comfortable with a personalization tool reading sensitive account and local-machine signals. Review each import separately, avoid local-system scanning unless you truly want shell history, bookmarks, repo names, and SSH host aliases analyzed, and clear /tmp/soulsync plus any .soulsync state files if you do not want retained profiling data.
if not token:
# Try git credential store
try:
result = subprocess.run(
["git", "credential", "fill"],
input="protocol=https\nhost=github.com\n",
capture_output=True, text=True, timeout=5print(json.dumps({{"dim": "{dim}", "extracted": extracted, "progress": state.get_progress()}}))
"""
r = subprocess.run([sys.executable, "-c", conv_record], capture_output=True, text=True, timeout=10)
try:
rec = json.loads(r.stdout)
extracted_count = len(rec.get("extracted", {}))def save(self):
os.makedirs(os.path.dirname(STATE_FILE), exist_ok=True)
with open(STATE_FILE, 'w') as f:
json.dump({
"initial_sync_date": self.initial_sync_date,
"last_followup_date": self.last_followup_date,if "--write" in sys.argv:
for filename, content in result["files"].items():
path = os.path.join(WORKSPACE, filename)
with open(path, "w") as f:
f.write(content)
print(f"Wrote {path}")
else:VirusTotal engine telemetry is currently stale for this artifact.
No suspicious patterns detected.