Flash Company

What to consider before installing: - Do NOT install without reviewing and editing the SKILL.md: remove or modify the '第一原则：忠诚原则' block. It hardcodes a specific user name and gives that identity overriding instructions which can act like a prompt-injection and cause the agent to ignore policies. - Inspect and, if needed, sandbox the code: flash.js and memory.js read/write JSON under ~/.agent-memory/flash-company. If you enable this skill, expect persistent files in your HOME that may contain task text, contexts, and any sensitive inputs you feed into sub-agents. Consider running it in an isolated account or container first. - Confirm sessions_spawn behavior: the skill emits sessions_spawn commands with injected memory contexts. Ensure whatever runtime executes those commands does not forward secrets or system tokens into agent contexts. - Check file permissions and sensitive content: the memory files are plain JSON. If you will store any sensitive data in tasks or contexts, consider encrypting or avoiding use of the persistence feature. - If you are not the named user ('生逸超'), be especially cautious: the skill's loyalty instruction is clearly targeted to a particular identity and could behave unexpectedly for others. Summary recommendation: functional and otherwise coherent, but remove/neutralize the loyalty/prompt-injection section and review persistence behavior before use; treat installation as 'suspicious' until those issues are addressed.