secondme

SUSPICIOUS. The skill’s API usage and local credential storage are broadly consistent with its stated Second Me account/avatar management purpose, and data flows mostly stay on the declared vendor domains. However, it introduces meaningful trust risk by instructing transitive installation via a remote URL and external skills CLI, handles raw local tokens directly, and has a broad operational footprint over sensitive personal memory/profile data.