Security checks across malware telemetry and agentic risk
This memory skill is not clearly malicious, but it handles private memories, API keys, GitHub sync, and persistent shell changes with enough scoping and credential-handling problems that users should review it carefully before installing.
Install only if you are comfortable with a memory tool that can read and write local memory files, index private notes, call external embedding providers, and sync memory content through GitHub. Prefer manual install over curl-to-bash, use --no-shell-rc, avoid storing API keys in shell startup files, use a private dedicated repository, review the remote URL before syncing, and do not store secrets or highly sensitive personal data in the memory repository.
if token and "https://github.com" in clone_url:
clone_url = clone_url.replace("https://", f"https://{token}@")
os.makedirs(os.path.dirname(repo_dir) or ".", exist_ok=True)
subprocess.run(["git", "clone", clone_url, repo_dir], check=True)
print(f"✅ 克隆完成: {repo_dir}")
else:
print(f"✅ 仓库已存在，跳过克隆: {repo_dir}")os.chmod(cred_file, 0o600)
except Exception:
pass
subprocess.run(
["git", "config", "credential.helper",
f"store --file {cred_file}"],
cwd=repo_dir, check=True,else:
print(f"⬇️ 克隆仓库: {repo_url}")
os.makedirs(os.path.dirname(target_dir) or ".", exist_ok=True)
subprocess.run(["git", "clone", repo_url, target_dir], check=True)
print(f"✅ 克隆完成: {target_dir}")
else:
# 本地初始化if os.path.exists(user_dir):
content = build_user_index(base_dir, uid)
index_path = os.path.join(user_dir, "INDEX.md")
with open(index_path, "w", encoding="utf-8") as f:
f.write(content)
print(f"✅ 个人索引已更新: users/{uid}/INDEX.md")
else:cwd=repo_dir, check=True,
)
subprocess.run(
["git", "remote", "add", "origin", clean_url],
cwd=repo_dir, check=True,
)if token and "https://github.com" in clone_url:
clone_url = clone_url.replace("https://", f"https://{token}@")
os.makedirs(os.path.dirname(repo_dir) or ".", exist_ok=True)
subprocess.run(["git", "clone", clone_url, repo_dir], check=True)
print(f"✅ 克隆完成: {repo_dir}")
else:
print(f"✅ 仓库已存在，跳过克隆: {repo_dir}")user_report += f"- {s}\n"
else:
user_report += "- ✅ 状态良好\n"
with open(stats_path, "w", encoding="utf-8") as f:
f.write(user_report)
print(f"\n✅ 个人统计已写入: users/{uid}/STATS.md")else:
print(f"⬇️ 克隆仓库: {repo_url}")
os.makedirs(os.path.dirname(target_dir) or ".", exist_ok=True)
subprocess.run(["git", "clone", repo_url, target_dir], check=True)
print(f"✅ 克隆完成: {target_dir}")
else:
# 本地初始化66/66 vendors flagged this skill as clean.