Smart Memory

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.dangerous_exec, suspicious.env_credential_access

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing this way can execute whatever code is currently on the remote master branch and install-time scripts may change between review and use.

Why it was flagged

The installer encourages piping a remote script to bash, pulls the current GitHub master branch without a pinned release or checksum, and then runs npm install. This is a supply-chain risk, especially because the registry says there is no install spec.

Skill content

# Usage: curl -sL https://raw.githubusercontent.com/BluePointDigital/smart-memory/master/install.sh | bash ... git clone --depth 1 "$REPO_URL.git" smart-memory-temp ... npm install --silent

Recommendation

Use a pinned release or commit hash, publish a real install spec, avoid curl-to-bash installation, and document exactly which commands will run before users install.

ConcernMedium Confidence

ASI05: Unexpected Code Execution

What this means

A normal npm install can run local commands and install dependencies before the user has separately reviewed those commands.

Why it was flagged

The static scan shows the npm postinstall script shells out. Because install.sh runs npm install and comments that postinstall creates the Python venv and installs requirements, users may get command execution during setup that is not represented in the registry install metadata.

Skill content

const result = spawnSync(command, args, {

Recommendation

Move environment setup into an explicit, documented command, or make postinstall no-op by default and require user confirmation for shelling out.

ConcernMedium Confidence

ASI02: Tool Misuse and Exploitation

What this means

Any local client able to reach the service could potentially trigger major memory-state changes, not just search or commit normal memories.

Why it was flagged

The visible FastAPI route exposes a high-impact rebuild operation on the memory state, and the shown route does not include an authentication, confirmation, or scoping check.

Skill content

@app.post("/rebuild") async def rebuild(request: Request): ... return jsonable_encoder(system.rebuild_all_memory_state())

Recommendation

Gate destructive or bulk-mutating endpoints behind explicit user confirmation, local auth, or a separate admin mode, and document the operational impact.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Private conversation details, preferences, identities, and task history may remain on disk and be reused in future agent responses.

Why it was flagged

The skill intentionally persists transcripts as canonical truth and derives reusable memories from them. This is core to the stated purpose, but the stored content may contain sensitive user data and can later shape prompts.

Skill content

- immutable local transcript logging with `sessions`, `transcript_messages`, and `memory_evidence` ... transcript messages are the source of truth

Recommendation

Install only if persistent local memory is desired; keep the data directory private, back it up carefully, and look for or request clear deletion/retention controls.

NoteHigh Confidence

ASI01: Agent Goal Hijack

What this means

The agent may consult stored memory automatically when it thinks continuity or prior preferences matter.

Why it was flagged

The skill instructs the agent to call memory retrieval before certain answers. This is aligned with a memory tool, but it does steer tool use and response grounding.

Skill content

Always retrieve before: - summarizing prior discussions - referencing earlier decisions - recalling user preferences

Recommendation

Keep this behavior enabled only if you want automatic continuity; otherwise require explicit user approval before memory retrieval or memory-based claims.

Findings (4)

critical

suspicious.dangerous_exec

Location: examples/session-start/nodejs-agent.js:49
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: smart-memory/index.js:158
Finding: Shell command execution detected (child_process).

critical

suspicious.dangerous_exec

Location: smart-memory/postinstall.js:14
Finding: Shell command execution detected (child_process).

critical

suspicious.env_credential_access

Location: smart-memory/index.js:11
Finding: Environment variable access combined with network send.