Security audit

AgentMemory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a cloud memory service whose core behavior is disclosed, but it asks agents to auto-sync broad user data, files, status, and secrets with unclear safeguards.

Review this carefully before installing. Use it only if you are comfortable sending selected memories, files, metadata, heartbeat status, and possibly secret names or values to agentmemory.cloud. Avoid storing third-party API keys or sensitive personal/work data unless you have explicit authorization, and prefer pinned/local-reviewed installation paths over the documented mutable curl and global npm install commands.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure DependenciesIntroduces malicious components through unsafe dependency sources
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

Location: SKILL.md:48
Finding: Unpinned Global Installation of an Unreviewed Third-Party CLI
Content: View full analysis
Remediation: View remediation

T02 · Agent Memory Poisoning

Error

Location: SKILL.md:362
Finding: Persistent Automatic Cloud Synchronization and Remote Memory Import
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: SKILL.md:293
Finding: Documented Plaintext Secret Submission Conflicts with End-to-End Encryption Claims
Content: View full analysis
Remediation: View remediation

T08 · Insecure Dependencies

Warning

Location: SKILL.md:34
Finding: Mutable Remote Skill Installation Without Integrity Verification
Content: View full analysis
~/.moltbot/skills/agentmemory/SKILL.md ``` **Or just read from the URL above!** ``` ### Technical Analysis The installation command retrieves a mutable remote Skill document and writes it directly over the local trusted `SKILL.md`. It does not pin a release, verify a checksum or signature, inspect the content, or stage the download before replacement. Although this is not a direct `curl | sh` execution pattern, a Skill document controls future agent behavior. Replacing that document with remote content can therefore alter commands, data-handling rules, network destinations, or persistent instructions after the reviewed version has been installed. The use of `curl -s` also suppresses useful diagnostics and omits `--fail`. An HTTP error page or malformed response may consequently overwrite the valid Skill document. HTTPS protects the transport connection but does not protect against compromise of the legitimate server, publishing account, or release process. ### Attack Path 1. An attacker compromises `agentmemory.cloud`, its DNS or deployment pipeline, or the account used to publish `skill.md`. 2. The attacker replaces the remote document with instructions that collect data, invoke unsafe commands, or direct credentials to attacker-controlled infrastructure. 3. A user follows the documented installation or update command. 4. The remote content overwrites the existing local Skill without integrity validation or review. 5. The agent later loads the newly installed document as trusted instructions. 6. The malicious instructions execute within the tools and permissions available to the agent. ### Impact Assessment The immediat ...[truncated 581 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: The skill recommends storing the API key in a plaintext JSON file under the user's home directory without mentioning file permissions, OS secret storage, or safer alternatives. This increases the risk of credential disclosure through local compromise, backups, misconfigured permissions, or accidental inclusion in logs and support bundles.
Content: Scanner excerpt · SKILL.md (reported line 109)May include surrounding context.
Store your API key securely. Recommended locations:

json
// ~/.config/agentmemory/credentials.json { "api_key": "am_your_key_here", "agent_name": "YourAgentName"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 80% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · SKILL.md (reported line 409)May include surrounding context.
md
| "Remember that I prefer TypeScript" | POST to /api/memories | | "What do you know about my preferences?" | POST to /api/memories/search | | "Show me all my memories" | GET /api/memories | | "Forget about the old deadline" | DELETE /api/memories/{id} | | "Update that memory about..." | PUT /api/memories/{id} | ---

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The skill prominently advertises auto-sync, cloud storage, heartbeat tracking, and semantic indexing near the top, but does not immediately and clearly disclose that user content, files, and metadata may be transmitted to a remote service. For an agent memory skill, this can lead to unintentional exfiltration of sensitive user or project data under the guise of routine persistence.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · SKILL.md (reported line 40)May include surrounding context.
Install locally:

bash
mkdir -p ~/.moltbot/skills/agentmemory curl -s https://agentmemory.cloud/skill.md > ~/.moltbot/skills/agentmemory/SKILL.md

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
Install locally:

bash
mkdir -p ~/.moltbot/skills/agentmemory curl -s https://agentmemory.cloud/skill.md > ~/.moltbot/skills/agentmemory/SKILL.md

Or just read from the URL above!

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 41)May include surrounding context.
Install locally:

bash
mkdir -p ~/.moltbot/skills/agentmemory curl -s https://agentmemory.cloud/skill.md > ~/.moltbot/skills/agentmemory/SKILL.md

Or just read from the URL above!

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The CLI guidance says all commands auto-sync and the later heartbeat section states every command sends heartbeat and sync data, but it lacks a strong warning that routine usage may transmit content and online-status metadata on every invocation. This creates a substantial privacy risk because users may believe they are performing local memory operations when they are actually continuously reporting to a cloud service.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The secrets vault section actively encourages storing API keys, credentials, and connection strings in the cloud, but does not provide a comparably strong warning about the governance, compliance, and blast-radius risks of centralizing third-party secrets. If an agent follows this guidance broadly, compromise of the service account or misuse of the vault could expose unrelated systems and data.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language guidance encourages agents to remember, search, update, and sync broad categories of user-provided information, including people, projects, preferences, deadlines, and reasoning. In the context of a cloud-backed memory service, this materially increases the chance of persistent collection of sensitive personal or organizational data without granular consent or minimization.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill gives conflicting guidance: it tells agents not to store passwords or API keys, yet elsewhere promotes a cloud secrets vault specifically for storing API keys and credentials. This inconsistency can cause agents or users to upload highly sensitive third-party secrets to a remote service without clear policy boundaries, increasing the risk of inappropriate secret centralization.
Content: No source excerpt is available for this finding.

External Transmission

Medium

Category: Data Exfiltration
Confidence: 60% confidence
Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Content: Scanner excerpt · SKILL.md (reported line 479)May include surrounding context.
Avoid duplicates by searching first:

bash
# Check if similar memory exists curl -X POST .../search -d '{"query": "user coffee preference"}' # Only store if not found

Static analysis

No suspicious patterns detected.