yotta-logs@0.3.4
VERIFIEDPublisher claims: "元史 —— 跨智能体的历史会话 / 记忆日志检索技能：零依赖检索 / 分析 JSONL、JSON、SQLite、Markdown 多格式会话与记忆文件，回溯旧对话与父会话上下文，为跨会话追溯提供原始日志依据。触发：用户问起先前聊过的内容 / 父会话 / 历史上下文、要查以前说过的结论、跨会话回溯某次讨论、需要从会话日志或记忆文件定位某段决策时。边界：仅读取本机自己的会话日志 / 记忆文件；不修改、不删除；只查本地不联网上传。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-02 and scored it 86/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationst+CategoryObserved action
0.1sprocessexec /usr/bin/dirname
0.1sprocessexec /usr/bin/uname
0.1sprocessexited 4: 目标错误: 未检测到项目级智能体目录。可用 --agent <name> 装到用户级，或用 --dir <路径> 指定目录。
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
Static findings
MEDIUM
npx invocation of non-well-known packagebin/install.js:7 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packagebin/install.js:6 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packagebin/install.js:10 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packagebin/install.js:9 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06MEDIUM
npx invocation of non-well-known packagebin/install.js:8 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06