bee-cli

Fail

Audited by Socket on Feb 16, 2026

1 alert found:

Malware
MalwareHIGH
SKILL.md

This is legitimate-looking CLI documentation for a wearable that records ambient audio and provides access to highly sensitive transcripts and derived personal facts. I found no explicit malicious code or obfuscated payloads in the documentation. The primary security concern is privacy: the skill's normal operation involves downloading, processing, and persisting verbatim conversation transcripts and aggregated personal profile data to local files and repeatedly fetching recent 10-hour windows. Those behaviors are coherent with the stated purpose but create a large local and operational attack surface; protecting stored files, authentication tokens, and transit is critical. Verify the CLI's actual implementation for secure local storage, E2EE key handling, token storage, and absence of any third-party proxying of user data before use.

Confidence: 80%Severity: 60%
Audit Metadata
Analyzed At
Feb 16, 2026, 12:34 AM
Package URL
pkg:socket/skills-sh/bee-computer%2Fbee-skill%2Fbee-cli%2F@23956089553ffc10bbcbdddfe655a6a7c7b10a2c