Kb Mini

What to check before installing: - Understand where the DB will live: the SKILL.md and scripts disagree on default paths. Inspect (and optionally set) KNOWLEDGE_DB and KNOWLEDGE_KB_MODE to ensure data is private and stored where you expect (set mode=private and a controlled DB path if unsure). - This skill auto-recalls before conversations and auto-captures after turns. If you do not want every conversation persisted, disable the hooks or raise the capture threshold (or avoid installing the generated hook scripts). - Review the scripts for unsafe interpolation: topic_key and other values are interpolated into sqlite3 commands without parameterization. Consider hardening (use parameterized sqlite3 access from Python or properly escape inputs) to avoid local SQL injection or DB corruption from crafted messages. - Shared KB mode allows multiple agents to read/write the same DB — enable only when you explicitly want cross-agent sharing and after you trust all participating agents. - Test in a sandbox: run the scripts on a throwaway agent and inspect the created DB and files. Verify sqlite3 on your system supports FTS5 (it is required). - If you plan to use this skill, consider adding explicit required config/env declarations and limit hook registration to manually enabled hooks so captures are explicit rather than automatic. Why 'suspicious' and not 'malicious': the code implements the advertised KB functionality and uses no unexpected network endpoints, but the undeclared config/env usage, automatic persistence across agents, and unsafe string interpolation are notable coherence and safety issues that should be fixed or accepted knowingly before use.