Local stores are unencrypted by default and not protected against another same-user process. Cloud model use may transmit recalled context to the user's provider. The program has no uploads, telemetry or cross-project scanning.

Natural-language scope, customer minimization and authentic provenance need the current AI's judgment. Regex checks are incomplete DLP. Source labels come from the caller; the program cannot independently prove that a claimed user/tool result occurred. Memory is historical data, not command authorization.

Stable opaque session/turn opt-outs survive controlled restore. Rephrased content under new IDs cannot be detected deterministically and is forbidden by the Skill. Paused-period content must never be backfilled. Deletion is logical, not secure disk erasure; cleanup warnings may need manual action. Transcripts, outside copies, Git history and snapshots are outside control.

Install reviewed trusted code. The npx entry uses npm/Git transport and cache policies, a package file whitelist, and no dependencies or lifecycle scripts. The alternative Python online installation fetches executable public code from this GitHub repository over HTTPS. Snapshot SHA-256 checks detect inconsistency; the manifest is not independently signed and cannot protect against a compromised repository. Network traffic is limited to public program downloads; no memory content is sent. Third-party managers have separate overwrite/telemetry rules. Keep one manager per installation and remove manually configured hooks before removal. Python-managed replacement refuses extra files/symlinks. Concurrent adversarial path swaps by a same-user process are outside the security boundary.

Report issues with synthetic reproduction steps and affected versions; do not paste credentials or customer logs.