project-memory

SUSPICIOUS. The skill’s local-only behavior and lack of external data routing argue against malware, but its footprint is broader than its stated project-memory purpose: it repeatedly scans global agent histories, configs, and unknown dotdirs to build handoff context. That makes it a medium-risk privacy and over-collection skill rather than a credential-stealing or clearly malicious one.