persistia-memory-for-claude-code

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly reads and stores plaintext credentials from .env (with example tokens like sk_live_xxxxx and ghp_xxxxx) and the setup step "asks for missing context (credentials...)", which means the agent may request, handle, and write secret values verbatim (and even version-control them), creating a high exfiltration risk.

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.90). These URLs include a raw shell script (https://raw.githubusercontent.com/.../setup.sh) that the documentation instructs you to curl | bash from an unverified GitHub user along with an unvetted short domain (ara.so), so executing the remote script is high-risk because it runs arbitrary code from an unknown source.

CRITICAL E006: Malicious code pattern detected in skill scripts.

• Malicious code pattern detected (high risk: 0.90). The skill explicitly reads and stores .env credentials and prompts for secrets into a plain-text, version-controlled "_brain" repo and offers optional GitHub backup (using a supplied GITHUB_TOKEN), and it installs via a remote curl|bash script and persistent scheduled jobs — all high-risk patterns that enable credential theft and data exfiltration if abused.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill instructs running a remote install script at runtime via "curl -fsSL https://raw.githubusercontent.com/bernardohcrocha/persistia-for-claude-code/main/setup.sh | bash", which downloads and immediately executes remote code (setup.sh) and is presented as a required installation step.