AgentOS SDK

• Outcome: Review
• Latest audit: Jul 10, 2026 · 3:48 AM UTC
• Version: 3.7.0

Overview

The skill is a real AgentOS memory toolkit, but it directs agents to persist broad context to cloud memory and defaults sensitive traffic to insecure HTTP/WebSocket endpoints.

Review before installing. Use only a trusted HTTPS/WSS AgentOS endpoint, avoid the raw-IP HTTP default, use least-privilege API keys, and disable or tightly limit heartbeat/cloud sync unless users explicitly approve what will be stored. Do not persist credentials, private conversations, customer data, regulated data, or detailed relationship profiles without retention and deletion rules.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (21)

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The guide mandates automatic syncing of session context and daily notes to a remote service every heartbeat, including broad content such as current session state and notes. This creates a clear data-exfiltration/privacy risk because sensitive prompts, secrets, customer data, or internal reasoning may be transmitted off-box without user consent, minimization, or classification checks.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document shows a credential-bearing config file with an API key example and instructs agents to inspect that file, but provides no safeguards against exposing, logging, or retransmitting the credentials. In an agent setting, this increases the chance that secrets are copied into logs, memory stores, prompts, or outbound messages.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The documentation explicitly recommends storing per-person relationship data, including preferences, communication style, past interactions, and important context, without any guidance on consent, minimization, retention limits, or access controls. In a memory system for AI agents, this encourages persistent collection of personal data that may be sensitive or unnecessary, creating privacy, compliance, and misuse risks if the data is over-collected, retained indefinitely, or exposed.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The best-practices examples encourage storing user preferences and 'everything important' for long-term recall, but they do not warn that these memories may contain sensitive personal or behavioral data. Because the product is designed for persistence and semantic search, this materially increases the chance of retaining private information longer and more broadly than users expect.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs the agent to persist task results, notes, pending work, and working memory after every task and at frequent checkpoints, but provides no safeguards for secrets, personal data, customer content, or internal operational details. This creates a durable data-retention channel that can capture sensitive context and later expose it through retrieval, debugging, or unauthorized access to the memory store.

Missing User Warnings

Low

• Confidence: 89% confidence
• Finding: The verification routine includes active network access via curl to a target URL without warning about external requests or requiring user approval. In an agent setting, this can leak metadata, trigger unintended outbound traffic, interact with attacker-controlled endpoints, or violate environment/network policies during routine 'verification' steps.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The skill's activation guidance is extremely broad, covering generic activities like storing memories, managing projects, tracking tasks, and communicating with other agents. In an agentic environment, such vague triggers can cause the skill to activate on many ordinary requests and gain access to memory, persistence, and mesh features without a narrowly scoped need, increasing the chance of unintended data handling or autonomous side effects.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The heartbeat protocol instructs the agent to continuously record conversation context, task state, and daily notes locally and sync them to cloud storage on every heartbeat, but does not require user consent, minimization, or sensitive-data filtering. Because the instructions are broad ('important conversation notes', 'what's happening in the session'), they can capture private user data, credentials, proprietary content, or regulated information and persist it automatically.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The WebSocket and webhook examples demonstrate sending API tokens and memory contents over network channels, including an insecure ws:// example and webhook payloads containing memory values, without prominent warnings about transport security, data exposure, or endpoint trust. This can normalize unsafe implementation patterns and lead operators to expose authentication material or sensitive memory contents to interception or third-party services.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The helper sends agent data and memory contents to a remote service by default, and the default base URL uses plain HTTP to a hard-coded IP address rather than HTTPS. That creates real confidentiality risk because API keys and memory payloads can be intercepted or redirected, and the script provides little user-facing warning about the privacy and transport-security implications.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The bulk export helpers can retrieve large volumes of memory data, including all memories for all agents in the tenant, with a single call. In an agent skill context, that meaningfully increases the blast radius of misuse or prompt-induced invocation because it enables mass exfiltration of potentially sensitive multi-agent data.

Missing User Warnings

Medium

• Confidence: 98% confidence
• Finding: The guide explicitly configures the AgentOS base URL over plaintext HTTP while instructing users to transmit an API key and potentially sensitive agent memory, context, and cross-agent data. This enables network attackers or intermediaries to observe or tamper with requests and responses, which could expose credentials, leak private data, or inject malicious memory/state into agent workflows.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The status command prints the first 20 characters of the API key to the terminal. Partial credential disclosure is sensitive because terminal output may be logged, shoulder-surfed, captured in screenshots, or stored in shell session transcripts, enabling correlation or facilitating token recovery when combined with other leaks.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The heartbeat backup protocol explicitly requires persisting broad session content, including 'important conversation notes,' to external memory by default. That encourages routine retention of potentially sensitive user communications and internal context, increasing risks of privacy violations, over-collection, and later misuse or unauthorized access.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The guide normalizes storing user preferences, decisions, and anything important for future sessions in searchable memory with high importance. Without boundaries on what counts as safe to retain, agents may persist personal, confidential, or security-relevant data longer than necessary and make it easier to retrieve broadly via semantic search.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: This section promotes durable storage of detailed interaction histories under /relationships, which can normalize profiling of individuals across sessions. In context, AgentOS is a long-term memory platform with search and version history, so broad retention of person-level context becomes more dangerous because it is easy to accumulate, rediscover, and repurpose personal data beyond the original interaction.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The file's core principle says anything not written to a file will be lost and instructs the agent to 'write to them obsessively,' effectively normalizing persistence of nearly all session context. In security terms, this encourages indiscriminate retention of user inputs, secrets, internal reasoning, and task artifacts, increasing both exposure surface and blast radius if the storage layer is later queried or compromised.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The progress and checkpoint functions direct the agent to record current tasks, results, pending work, and notes at high frequency, and the examples even reference production keys and payment integration context. That combination makes the danger concrete: routine operational logging can easily capture secrets, security architecture details, customer workflows, or incident context that should not be stored in broadly retrievable memory.

Ssd 3

Medium

• Confidence: 91% confidence
• Finding: The session-start and review flows normalize broad retrieval and display of accumulated memory, including working memory, pending tasks, daily logs, and learnings. Even if initial storage were well-intentioned, this bulk recall pattern increases the chance of resurfacing previously stored sensitive content into active context, logs, consoles, screenshots, or responses where it may be further exposed.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The heartbeat instructions explicitly require summarizing active conversations, recent events, and important notes, then syncing that material to AgentOS cloud storage every 10 minutes. This creates a systematic mechanism for exfiltrating or over-retaining sensitive user-derived context, especially because the guidance does not distinguish innocuous operational notes from confidential content.

External Transmission

Medium

• Category: Data Exfiltration

Content

local endpoint="$1"
  local data="$2"
  
  curl -s -X POST \
    --max-time "$AGENTOS_TIMEOUT" \
    -H "Authorization: Bearer $AGENTOS_API_KEY" \
    -H "Content-Type: application/json" \

• Confidence: 97% confidence
• Finding: curl -s -X POST \ --max-time "$AGENTOS_TIMEOUT" \ -H "Authorization: Bearer $AGENTOS_API_KEY" \ -H "Content-Type: application/json" \ -d

VirusTotal

58/58 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.install_untrusted_source

Install source points to URL shortener or raw IP.

Warn

• Code: suspicious.install_untrusted_source
• Location: skill.json:40