Security audit

AgentMemory

Security checks across malware telemetry and agentic risk

Overview

AgentMemory is a coherent cloud memory skill, but it asks agents to sync memories, files, secret metadata, and possibly credentials to a third-party service with broad automatic behavior and unclear security boundaries.

Install only if you intentionally want a third-party cloud memory service for your agent. Avoid production credentials, regulated personal data, and confidential files unless you have verified the service’s encryption model and retention controls. Pin and review the npm CLI before installing it globally, and require explicit confirmation before uploading files, storing sensitive memories, deleting memories, or revealing secrets.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Intent-Code Divergence

Medium

Confidence: 92% confidence
Finding: The documentation contradicts itself by advising agents not to store sensitive secrets while also promoting a dedicated secrets vault for API keys and credentials. This inconsistency can mislead agents or users into centralizing high-value secrets in a third-party cloud service without clear threat-model boundaries, increasing the risk of inappropriate disclosure or overcollection of credentials.

Intent-Code Divergence

High

Confidence: 97% confidence
Finding: The skill claims end-to-end encryption and zero-knowledge properties, but all documented examples show plaintext memories and secrets being sent directly in JSON bodies to the remote API, with no client-side encryption step or ciphertext format. If the service receives plaintext, it is not end-to-end encrypted in the ordinary sense, and users may be induced to trust the system with highly sensitive data under false assumptions.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill heavily promotes automatic syncing of memories, files, and secrets to a cloud service, but the privacy and transmission implications are not presented as an upfront consent warning near the core feature description. An agent following this guidance may upload sensitive conversational context or user data by default, creating unintended disclosure to a remote provider.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The file upload section encourages sending arbitrary files and states that content is automatically extracted and indexed for semantic search, but does not clearly warn that uploaded documents are transmitted to the cloud and processed server-side. Users may reasonably upload confidential documents without understanding the processing and exposure implications.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The heartbeat feature performs automatic sync and online-status reporting, including returning synced memories and secret names, yet the documentation does not clearly foreground the activity-tracking and metadata-leakage implications. This can create covert or unexpected telemetry about agent presence, usage cadence, and stored data inventory.

VirusTotal

43/43 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.