bee-cli
Audited by Socket on Feb 16, 2026
1 alert found:
MalwareThis is legitimate-looking CLI documentation for a wearable that records ambient audio and provides access to highly sensitive transcripts and derived personal facts. I found no explicit malicious code or obfuscated payloads in the documentation. The primary security concern is privacy: the skill's normal operation involves downloading, processing, and persisting verbatim conversation transcripts and aggregated personal profile data to local files and repeatedly fetching recent 10-hour windows. Those behaviors are coherent with the stated purpose but create a large local and operational attack surface; protecting stored files, authentication tokens, and transit is critical. Verify the CLI's actual implementation for secure local storage, E2EE key handling, token storage, and absence of any third-party proxying of user data before use.