Security audit
Security checks across malware telemetry and agentic risk
This is a local second-brain app, but it exposes unauthenticated local APIs and can send chat, memory, embeddings, or uploaded content to configured model services despite strong offline/local messaging.
Install only if you are comfortable running a local web service that stores and exposes conversation/upload-derived memory through localhost APIs. Keep it bound to 127.0.0.1, do not expose the port to a network, avoid visiting untrusted sites while it is running, and review any OPENAI_API_KEY, DEEPSEEK_API_KEY, OLLAMA_HOST, or model settings before use. Do not upload sensitive documents unless you have disabled remote providers and are comfortable with the app’s memory consolidation and pruning behavior.
"download_url": "https://ollama.com/download",
}
try:
subprocess.Popen(
[binary, "serve"],
stdout=subprocess.DEVNULL,
stderr=subprocess.DEVNULL,if api_key and not is_ollama:
headers["Authorization"] = f"Bearer {api_key}"
req = urlrequest.Request(url, data=data, headers=headers, method="POST")
with urlrequest.urlopen(req, timeout=120) as resp:
payload = json.loads(resp.read().decode("utf-8", errors="replace"))
reply = ""headers={"Content-Type": "application/json"},
method="POST",
)
with urlrequest.urlopen(req, timeout=5.0) as response:
res_data = json.loads(response.read().decode("utf-8", errors="replace"))
vector = res_data.get("embedding") or []
if vector:},
method="POST",
)
with urlrequest.urlopen(req, timeout=12.0) as response:
res_data = json.loads(response.read().decode("utf-8", errors="replace"))
vector = None
if isinstance(res_data.get("embedding"), list):headers={"Content-Type": "application/json"},
method="POST",
)
with urlrequest.urlopen(req, timeout=30.0) as response:
res_data = json.loads(response.read().decode("utf-8", errors="replace"))
raw_text = res_data.get("response", "")
return _parse_visual_relationships(raw_text)VirusTotal findings are pending for this skill version.