contexto
Security checks across malware telemetry and agentic risk
Overview
Contexto is internally consistent with its description: it implements a context engine that buffers and sends full conversation episodes to a hosted API (api.getcontexto.com) using a plugin config API key — there are no unexplained privileges or installs, but installing it will send full turns (including tool outputs) to an external service, so review data handling before enabling it in production.
This plugin does exactly what it says: it stores and retrieves full conversation episodes to/from a hosted Contexto service at api.getcontexto.com. Before installing, consider: 1) Sensitive data exposure — the plugin will send user messages, assistant replies, and tool outputs to the external service; confirm that sending this data is acceptable for your privacy and compliance needs. 2) API key management — use a scoped/rotatable key, and avoid sharing a high-privilege or long-lived key. 3) Review retention and access controls at getcontexto.com (or consider self-hosting) if your data is sensitive. 4) You can disable ingestion by omitting the apiKey or toggling contextEnabled in the plugin config. 5) The package appears coherent, but minor metadata/version inconsistencies exist (package.json vs registry) — that's a release hygiene issue, not a functional red flag.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings
