AgentMemory

• Outcome: Review
• Latest audit: Sep 10, 2026 · 7:42 AM UTC
• Version: 1.3.0

Overview

This skill is a cloud memory service whose core behavior is disclosed, but it asks agents to auto-sync broad user data, files, status, and secrets with unclear safeguards.

Review this carefully before installing. Use it only if you are comfortable sending selected memories, files, metadata, heartbeat status, and possibly secret names or values to agentmemory.cloud. Avoid storing third-party API keys or sensitive personal/work data unless you have explicit authorization, and prefer pinned/local-reviewed installation paths over the documented mutable curl and global npm install commands.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:48
• Finding: Unpinned Global Installation of an Unreviewed Third-Party CLI<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 48-55 **Vulnerability Type**: Unpinned third-party dependency with global installation **Risk Level**: High ### Vulnerable Code ```bash # Install via npm npm install -g agentmemory-cli # Setup (auto-syncs everything!) agentmemory init ``` ### Technical Analysis The Skill instructs users to globally install the latest available version of `agentmemory-cli` without a version constraint, integrity hash, lockfile, package signature, or source-review requirement. A global npm installation may execute package lifecycle scripts and installs executable code under the permissions of the invoking user. The implementation of this CLI is not included in the audited project, so its actual filesystem access, encryption behavior, credential handling, initialization process, and synchronization scope cannot be verified. The subsequent `agentmemory init` operation is expressly described as automatically synchronizing data, further increasing the potential impact of an untrusted or compromised package. This dependency is directly related to the declared functionality, but the unrestricted installation and execution method grants more trust than is minimally necessary. ### Attack Path 1. An attacker compromises the npm publisher account, package repository, release pipeline, or a transitive dependency. 2. The attacker publishes a malicious version under the existing `agentmemory-cli` package name. 3. A user follows the Skill and runs `npm install -g agentmemory-cli`. 4. npm retrieves the current malicious release because no version or integrity value is pinned. 5. Malicious lifecycle or CLI code executes with the user's permissions. 6. The package can access files and environment variables available to the user, including the AgentMemory credential and data selected for synchronization. 7. The attacker can exfiltrate data, alter local files, or manipulate synchronized memories. ### Impact Assessment ...[truncated 488 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Pin the CLI to a specifically reviewed version rather than installing the latest release. - Publish and verify a cryptographic integrity digest or signed release manifest. - Include the relevant CLI source, dependency lockfile, and security documentation in the auditable artifact. - Prefer a project-local, sandboxed installation instead of a global npm installation. - Disable npm lifecycle scripts during installation unless they are documented and independently reviewed. - Document every local path, environment variable, and network destination accessed by initialization. - Require explicit user selection and confirmation of each synchronization category. - Run the CLI with the least-privileged account and restrict filesystem and network access where sandboxing is available. ]]>

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:362
• Finding: Persistent Automatic Cloud Synchronization and Remote Memory Import<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 362-371 **Vulnerability Type**: Persistent agent-state modification and overly broad automatic synchronization **Risk Level**: High ### Vulnerable Code ```markdown **Note:** The CLI handles all of this automatically! Every command sends a heartbeat and syncs data. You don't need to manage this manually. ### Add to your HEARTBEAT.md ```markdown ## AgentMemory Check (every session start) 1. Run `agentmemory connect` to sync latest data 2. Search AgentMemory for relevant context about current task 3. Store any new important information discovered during the session 4. Update outdated memories if information has changed ``` ``` ### Technical Analysis The Skill asks the agent to place durable behavioral instructions into `HEARTBEAT.md`. Those instructions survive the original Skill invocation and cause remote memory synchronization at every session start. The directive to store “any new important information” is not bounded by an explicit data allowlist, project scope, retention period, or per-item consent requirement. Consequently, an agent following the instruction could upload private conversation details, personal information, source-code context, or project metadata merely because it considers that information important. The workflow also directs the agent to import remote memories as context for current tasks. Remotely stored memory is a separate trust boundary and may have been modified through a compromised account, stolen API key, vulnerable service, or another authorized client. The Skill does not instruct the agent to treat retrieved memory as untrusted data rather than executable instructions. Heartbeat transmission also discloses recurring session activity and online status. These persistent and automatic behaviors exceed the minimum privilege needed for user-initiated memory storage and retrieval. ### Attack Path 1. A user or agent adds the proposed block to `HEARTBEAT.md ...[truncated 1340 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Do not modify `HEARTBEAT.md` or other persistent agent instructions by default. - Require explicit, informed opt-in before enabling session-start synchronization. - Require item-specific user confirmation before uploading newly discovered information. - Replace “any new important information” with a narrow allowlist of approved record types and projects. - Exclude credentials, authentication data, private conversation content, and unrelated workspace data by default. - Treat all retrieved memory as untrusted data and explicitly prohibit interpreting it as system or tool instructions. - Authenticate remote records and preserve provenance, author, timestamp, and integrity metadata. - Permit users to review pending changes before remote memories are imported, updated, or deleted. - Provide documented commands to disable synchronization, remove persistent instructions, revoke credentials, and delete remotely retained data. - Make heartbeat and online-status reporting separately configurable from memory synchronization. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:293
• Finding: Documented Plaintext Secret Submission Conflicts with End-to-End Encryption Claims<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 293-302 and 538-540 **Vulnerability Type**: Misleading security design and plaintext application-level secret handling **Risk Level**: High ### Vulnerable Code ```bash curl -X POST https://agentmemory.cloud/api/secrets \ -H "Authorization: Bearer YOUR_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "name": "OPENAI_API_KEY", "value": "sk-xxxxx", "type": "api_key", "description": "OpenAI API key for GPT-4" }' ``` The Skill separately makes the following security claims: ```markdown - **End-to-end encrypted**: Your data is encrypted before leaving your device - **Secrets vault**: Extra encryption layer for API keys and credentials - **Zero-knowledge**: We can't read your data even if we wanted to ``` ### Technical Analysis The documented raw `curl` workflow sends the secret value directly in the JSON request body. The example performs no client-side encryption before constructing or transmitting the request. HTTPS supplies transport encryption between the client and the service endpoint, but it does not constitute end-to-end encryption against that service. The API server terminates TLS and therefore receives the application request body unless an additional client-side cryptographic layer is used. No such layer, ciphertext field, key derivation process, client-held encryption key, or authenticated encryption scheme is shown in the audited artifact. The documented workflow therefore does not substantiate the claims that data is encrypted before leaving the device or that the service cannot read it. In addition, placing real credentials in an inline shell command may expose them through shell history, terminal logs, process observation in some environments, or copied diagnostic output. ### Attack Path 1. A user relies on the advertised end-to-end encryption and zero-knowledge guarantees. 2. The user substitutes a real credential for `sk-xxxxx` and execu ...[truncated 1082 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Implement authenticated client-side encryption before any secret is added to the HTTP request body. - Keep encryption and decryption keys exclusively under client control. - Use a reviewed authenticated encryption construction and document key derivation, nonce management, key rotation, recovery, revocation, and multi-device synchronization. - Make the API accept ciphertext rather than plaintext secret values. - Remove or qualify the end-to-end encryption and zero-knowledge claims until the documented raw API flow provides those properties. - Obtain an independent cryptographic and architectural review. - Avoid placing real secret values directly in shell command lines. - Accept secrets through protected standard input, an interactive no-echo prompt, or a permission-restricted file descriptor. - Ensure application, proxy, analytics, and error logs never record authorization headers or secret payloads. - Explain clearly that HTTPS provides transport encryption and is not, by itself, zero-knowledge encryption from the service. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:34
• Finding: Mutable Remote Skill Installation Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 34-42 **Vulnerability Type**: Unverified retrieval and replacement of trusted Skill instructions **Risk Level**: Medium ### Vulnerable Code ```markdown **Install locally:** ```bash mkdir -p ~/.moltbot/skills/agentmemory curl -s https://agentmemory.cloud/skill.md > ~/.moltbot/skills/agentmemory/SKILL.md ``` **Or just read from the URL above!** ``` ### Technical Analysis The installation command retrieves a mutable remote Skill document and writes it directly over the local trusted `SKILL.md`. It does not pin a release, verify a checksum or signature, inspect the content, or stage the download before replacement. Although this is not a direct `curl | sh` execution pattern, a Skill document controls future agent behavior. Replacing that document with remote content can therefore alter commands, data-handling rules, network destinations, or persistent instructions after the reviewed version has been installed. The use of `curl -s` also suppresses useful diagnostics and omits `--fail`. An HTTP error page or malformed response may consequently overwrite the valid Skill document. HTTPS protects the transport connection but does not protect against compromise of the legitimate server, publishing account, or release process. ### Attack Path 1. An attacker compromises `agentmemory.cloud`, its DNS or deployment pipeline, or the account used to publish `skill.md`. 2. The attacker replaces the remote document with instructions that collect data, invoke unsafe commands, or direct credentials to attacker-controlled infrastructure. 3. A user follows the documented installation or update command. 4. The remote content overwrites the existing local Skill without integrity validation or review. 5. The agent later loads the newly installed document as trusted instructions. 6. The malicious instructions execute within the tools and permissions available to the agent. ### Impact Assessment The immediat ...[truncated 581 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Distribute immutable, versioned Skill releases. - Publish a cryptographic digest and detached signature through an independently protected channel. - Verify the expected digest or signature before installing the document. - Use `curl --fail --show-error --location` rather than silent retrieval. - Download to a permission-restricted temporary file and validate the content before installation. - Require human review or display a diff before replacing an existing Skill. - Perform replacement atomically only after all checks succeed. - Retain the prior known-good version to support rollback. - Document a trusted update policy and avoid recommending direct consumption of a mutable URL as agent instructions. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Credential Access

High

• Category: Privilege Escalation

Content

Store your API key securely. Recommended locations:

```json
// ~/.config/agentmemory/credentials.json
{
  "api_key": "am_your_key_here",
  "agent_name": "YourAgentName"

• Confidence: 84% confidence
• Finding: The skill recommends storing the API key in a plaintext JSON file under the user's home directory without mentioning file permissions, OS secret storage, or safer alternatives. This increases the risk of credential disclosure through local compromise, backups, misconfigured permissions, or accidental inclusion in logs and support bundles.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

| "Remember that I prefer TypeScript" | POST to /api/memories |
| "What do you know about my preferences?" | POST to /api/memories/search |
| "Show me all my memories" | GET /api/memories |
| "Forget about the old deadline" | DELETE /api/memories/{id} |
| "Update that memory about..." | PUT /api/memories/{id} |

---

• Confidence: 80% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill prominently advertises auto-sync, cloud storage, heartbeat tracking, and semantic indexing near the top, but does not immediately and clearly disclose that user content, files, and metadata may be transmitted to a remote service. For an agent memory skill, this can lead to unintentional exfiltration of sensitive user or project data under the guise of routine persistence.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Install locally:**
```bash
mkdir -p ~/.moltbot/skills/agentmemory
curl -s https://agentmemory.cloud/skill.md > ~/.moltbot/skills/agentmemory/SKILL.md
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Skill Enumeration

Medium

• Category: Agent Snooping

Content

**Install locally:**
```bash
mkdir -p ~/.moltbot/skills/agentmemory
curl -s https://agentmemory.cloud/skill.md > ~/.moltbot/skills/agentmemory/SKILL.md
```

**Or just read from the URL above!**

• Confidence: 80% confidence
• Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

External Transmission

Medium

• Category: Data Exfiltration

Content

**Install locally:**
```bash
mkdir -p ~/.moltbot/skills/agentmemory
curl -s https://agentmemory.cloud/skill.md > ~/.moltbot/skills/agentmemory/SKILL.md
```

**Or just read from the URL above!**

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The CLI guidance says all commands auto-sync and the later heartbeat section states every command sends heartbeat and sync data, but it lacks a strong warning that routine usage may transmit content and online-status metadata on every invocation. This creates a substantial privacy risk because users may believe they are performing local memory operations when they are actually continuously reporting to a cloud service.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The secrets vault section actively encourages storing API keys, credentials, and connection strings in the cloud, but does not provide a comparably strong warning about the governance, compliance, and blast-radius risks of centralizing third-party secrets. If an agent follows this guidance broadly, compromise of the service account or misuse of the vault could expose unrelated systems and data.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The natural-language guidance encourages agents to remember, search, update, and sync broad categories of user-provided information, including people, projects, preferences, deadlines, and reasoning. In the context of a cloud-backed memory service, this materially increases the chance of persistent collection of sensitive personal or organizational data without granular consent or minimization.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The skill gives conflicting guidance: it tells agents not to store passwords or API keys, yet elsewhere promotes a cloud secrets vault specifically for storing API keys and credentials. This inconsistency can cause agents or users to upload highly sensitive third-party secrets to a remote service without clear policy boundaries, increasing the risk of inappropriate secret centralization.

External Transmission

Medium

• Category: Data Exfiltration

Content

Avoid duplicates by searching first:
```bash
# Check if similar memory exists
curl -X POST .../search -d '{"query": "user coffee preference"}'
# Only store if not found
```

• Confidence: 60% confidence
• Finding: Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Static analysis

No suspicious patterns detected.