hindsight-local

SUSPICIOUS: The skill’s core function is coherent and uses an official, verifiable package path, so this is not confirmed malware. However, it normalizes broad retention of full conversations, stores provider API keys locally, and may forward user content to external LLM services despite being framed as 'local,' creating moderate privacy and security risk.