AgentMemory

• Analyzed: May 12, 2026, 3:14 AM
• Findings: 1
• Version: 1.3.0
• Hash: d0ed4b113c7b30924409fcffe8d556cd37a33ea6836091763937187f69877b50
• Source: palm
• External report: View on VirusTotal

Findings (1)

The skill is classified as suspicious primarily due to the instruction to `npm install -g agentmemory-cli` in `SKILL.md`. This command introduces a significant supply chain risk, as a globally installed npm package can execute arbitrary code during installation or runtime, potentially leading to malicious execution or data exfiltration if the package is compromised or malicious. While the skill includes defensive instructions against API key exfiltration to unauthorized domains, the reliance on an external, globally installed package represents a high-risk capability without clear malicious intent within the provided files.