Qst Memory System
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The package and runtime instructions are consistent with a local memory-management skill: it implements embedding + QST-based retrieval, optional OpenAI/sentence-transformers integration, and local JSON/SQLite persistence; nothing in the files or SKILL.md appears to request unrelated credentials or hidden endpoints.
This skill appears coherent with its stated purpose, but take these practical precautions before installing or running it: 1) Review web_ui.py to confirm it binds to localhost (not 0.0.0.0) if you don't want a network-exposed service. 2) The SKILL.md installs from a GitHub repo via git clone — verify the repo contents and trust the author before cloning. 3) If you enable OpenAI or other external embedding providers, supply API keys only if you trust the code and be aware that those providers will receive the texts you embed. 4) Check where the skill will write its JSON/SQLite files and ensure you are comfortable with local persistence of conversation content. 5) Prefer running the code in a restricted environment (non-root user, isolated workspace) until you have inspected and tested it.
SkillSpector
SkillSpector findings are pending for this release.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
No VirusTotal findings