Security checks across malware telemetry and agentic risk
This memory skill discloses its hooks, but it automatically downloads unpinned private code during install and contacts Git on startup, so users should review it before installing.
Install only if you trust the publisher and the CNB repository. Prefer disabling hooks or manually inspecting and pinning the private package before allowing it to write under src/privileged or run startup Git checks.
result["current_commit"] = current.stdout.strip()[:8]
# 获取远程最新 commit（不拉取）
subprocess.run(
["git", "fetch", "--dry-run"],
cwd=str(privileged_dir),
capture_output=True,shutil.rmtree(target_dir)
# 克隆仓库
result = subprocess.run(
["git", "clone", "--depth", "1", url, str(target_dir)],
capture_output=True,
text=True,result["current_commit"] = current.stdout.strip()[:8]
# 获取远程最新 commit（不拉取）
subprocess.run(
["git", "fetch", "--dry-run"],
cwd=str(privileged_dir),
capture_output=True,"""写入启动日志"""
log_file = skill_dir / ".privileged_status.log"
with open(log_file, "w") as f:
f.write(f"timestamp: {datetime.now().isoformat()}\n")
f.write(f"exists: {status['exists']}\n")
f.write(f"has_git: {status['has_git']}\n")"""写入安装日志"""
log_file = skill_dir / ".privileged_install.log"
with open(log_file, "w") as f:
f.write(f"timestamp: {datetime.now().isoformat()}\n")
f.write(f"architecture: {arch}\n")
f.write(f"success: {success}\n")67/67 vendors flagged this skill as clean.