Kvstore

In-memory key-value store with TTL for AI agents. Set, get, delete, list, flush, and stats. Supports any JSON value, optional TTL per key, and prefix-based k...

Security Scan

The skill's code, instructions, and install steps align with its description: a local in-memory JSON key-value store with TTL and basic HTTP endpoints; nothing in the package indicates incoherent or hidden behavior.

Purpose & Capability

Name/description (KV store with TTL) match the included Python code and HTTP endpoints. Required binary (python) and declared pip packages (fastapi, uvicorn, pydantic) are appropriate and proportional to the stated purpose.

Instruction Scope

SKILL.md only instructs starting a local uvicorn server and shows curl examples for the documented endpoints (/v1/set, /v1/get, /v1/keys, /v1/delete, /v1/flush, /v1/stats). There are no instructions to read unrelated files, exfiltrate data, or call external endpoints.

Install Mechanism

Install uses pip to fetch fastapi/uvicorn/pydantic from PyPI (declared in metadata). This is expected for a FastAPI app; pip installs carry the usual supply-chain considerations but are not unusual or disproportionate here.

Credentials

No environment variables, credentials, or config paths are requested. The skill does not attempt to access unrelated secrets or system config.

Persistence & Privilege

always is false and the skill does not modify other skills or system-wide settings. It runs as a normal local service and maintains only in-memory state (no persistent storage).

Assessment

This skill appears to do exactly what it says: run a local HTTP server providing an in-memory JSON key-value store with TTL. Before installing or running it, consider: (1) network exposure — the SKILL.md starts uvicorn without explicit host, so ensure you bind to localhost or place it behind a firewall/reverse proxy if you don't want external access; there is no authentication, so anyone who can reach the server can read/modify data; (2) data persistence — state is in-memory only and will be lost on restart; (3) package provenance — the install uses pip to fetch FastAPI/uvicorn/pydantic from PyPI, which is normal but subject to normal supply-chain risks; (4) code review — the codebase is small and readable (no hidden endpoints), so review it yourself if you have concerns. Overall the skill is internally consistent and not suspicious.

Lightweight key-value store for agent state, caching, and data sharing.

Start the server

uvicorn kvstore.app:app --port 8013

Set a value

curl -s -X POST http://localhost:8013/v1/set \
  -H "Content-Type: application/json" \
  -d '{"key": "user:1", "value": {"name": "Alice", "role": "admin"}}' | jq

Set with TTL (auto-expires)

curl -s -X POST http://localhost:8013/v1/set \
  -H "Content-Type: application/json" \
  -d '{"key": "cache:token", "value": "abc123", "ttl_seconds": 3600}' | jq

Get a value

curl -s http://localhost:8013/v1/get/user:1 | jq

Returns key, value (any JSON), and ttl_remaining (seconds until expiry, or null).

List keys by prefix

curl -s "http://localhost:8013/v1/keys?prefix=user:" | jq

Delete / Flush / Stats

curl -s -X DELETE http://localhost:8013/v1/delete/user:1 | jq
curl -s -X POST http://localhost:8013/v1/flush | jq
curl -s http://localhost:8013/v1/stats | jq

Endpoints

Method	Path	Description
POST	/v1/set	Set a key-value pair (optional TTL)
GET	/v1/get/{key}	Get value by key
DELETE	/v1/delete/{key}	Delete a key
GET	/v1/keys	List keys (optional ?prefix=)
POST	/v1/flush	Delete all keys
GET	/v1/stats	Hit/miss counts and total keys