hindsight

SUSPICIOUS. The core memory workflow is broadly aligned with the stated purpose and uses a real official Hindsight CLI, but the skill’s footprint is large: always-on capture of prompts/edits/errors, autonomous hooks, suppressed background journaling, and an API endpoint on a non-official domain that is only explained by local /etc/hosts remapping. This looks more like an aggressive self-hosted memory integration than confirmed malware, but the destination trust and scope are not cleanly proportional or easily auditable.