Security audit
SmartContext — Intelligent Conversation Guidelines
Security checks across malware telemetry and agentic risk
Overview
The plugin's code, commands, and runtime instructions are consistent with its stated purpose (injecting domain-specific conversation guidelines), but installing untrusted SKILL.md files can inject arbitrary instructions into every conversation — review skill content before installing.
This skill appears to do what it says: inject tiered, domain-specific guidelines into prompts. However, its install command copies arbitrary SKILL.md files into the plugin's skills directory and those files are sent nearly verbatim into the model context. Only install SKILL.md files from trusted sources and review their content before installing — a malicious or poorly written SKILL.md can change model behavior across all conversations. Also be aware the plugin stores installed skills and its configuration in the gateway's state directory; avoid placing sensitive secrets inside SKILL.md files. If you need stricter control, keep the plugin disabled by default and enable it only when you trust the active skills.
VirusTotal
No VirusTotal findings
Static analysis
No suspicious patterns detected.
