Caveat verdict
cyber-memory
The skill processes session transcripts locally, which appears to be for its intended purpose of providing memory functionality.
โ Flagged for review โ coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis โ not a human review. Caveat flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Permission integrity
agent_memory
Findings (2)
References agent memory files
SKILL.md ยท code ยท MEMORY.md
Accesses sensitive environment variables
hooks/memory-flush/handler.ts ยท prose ยท downgraded ยท process.env.OPENAI_API_KEY
Permissions & capabilities
No declared permissions โ minimal attack surface.
agent_memorynetwork_in Is this flag fair?
Thanks โ recorded.