Cloud memory for AI agents. Store, search, and recall context across sessions.
Security Analysis
medium confidenceThe skill's purpose (cloud memory) matches its runtime instructions, but the SKILL.md asks the agent to obtain and persist an API key (and even to perform a tweet-based verification) while the registry metadata does not declare any required credential — this mismatch and the instructions to persist secrets warrant caution.
Name/description (cloud memory for agents) match the endpoints and examples in SKILL.md (remember, recall, bootstrap, recent, forget). The documented endpoints and operations are coherent with a memory/storage service.
The SKILL.md instructs the agent (or user) to register, capture an api_key, perform a verification step (tweet or follow a claim_url), and then store that key in config/environment. These runtime instructions grant the skill the ability to persist and use credentials. The doc does not direct the agent to read unrelated local files, but it does instruct credential storage and a social-media-based verification step which expands scope beyond simple read/search/recall.
This is an instruction-only skill with no install spec and no code files, so nothing is written to disk by the skill itself. That minimizes install-time risk.
The runtime instructions require an API key (CTXLY_API_KEY) but the registry metadata lists no required environment variables or primary credential. This mismatch is material: the skill will only function if a secret is created and stored, but that secret requirement was not declared. The skill does not request other unrelated credentials, but instructing agents to persist a bearer API key is a sensitive action and should be explicitly declared and justified in metadata.
The skill is not marked always:true, does not request system-wide changes, and has no install actions. Its main persistent effect is encouraging storage of an API key and remote memory records on an external service; that behavior is expected for a cloud-memory integration but requires user trust in the service.
Guidance
This skill appears to implement a cloud-memory service as described, but there are two things to watch before installing: (1) the SKILL.md tells you to register and persist an API key (CTXLY_API_KEY) and even to verify ownership via a tweet or claim URL, yet the registry metadata does not declare any required credential — ask the author to add CTXLY_API_KEY to requires.env so the required privilege is explicit; (2) storing a long-lived API key in your agent's environment means that the agent (and any skills it invokes) can access that key and any memories stored remotely — do not store sensitive secrets or private data in this memory and consider using a dedicated, limited-permission account or short-lived key. Also verify the trustworthiness and privacy policy of https://ctxly.app (who can read stored memories, retention, deletion guarantees), and prefer manual human-assisted registration if you do not want the agent to perform network actions autonomously.
Latest Release
v1.0.0
Initial release of ctxly: persistent cloud memory for agents. - Enables agents to store, search, and recall information across sessions. - Simple setup with agent registration, API key management, and verification options. - Offers endpoints to remember, search, recall recent, bootstrap on startup, and forget memories. - Includes rate limits (100 requests/min, 30 writes/min) and clear recommendations for what to store. - Full API reference and usage examples provided.
More by @aerialcombat
Published by @aerialcombat on ClawHub
