memory-fabric

SUSPICIOUS. The skill’s core memory-search purpose is plausible and most data flows are proportionate, but install trust is weakened by an unverified runtime `npx` package and a package-name mismatch with upstream memory server docs. Capability documentation also overstates the available MCP/tool surface. I see no confirmed malware or credential-exfiltration behavior, but the provenance inconsistency and runtime package execution justify medium risk.