Agentmm Skills

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:51 PM UTC
• Version: 1.0.1

Overview

The skill largely matches its memory/logging purpose, but it sends persistent agent data and credentials to a configurable remote endpoint without enforcing the HTTPS protection its documentation promises.

Install only if you trust AgentMM or a self-hosted endpoint, avoid storing secrets or sensitive client data as memories/logs, require approval before autonomous memory writes in sensitive workspaces, and ensure AGENTMM_API_BASE is HTTPS and under your control. Stop sync_daemon when not needed and confirm the service's retention and deletion behavior before relying on it.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/write_memory.sh:12

Finding

Configurable API Base Allows Plaintext Transmission of Credentials and Memory Data

Content

View full analysis

Remediation

View remediation

&2 exit 1 ;; esac ``` 2. Restrict curl to HTTPS and require a modern TLS version: ```bash curl --proto '=https' --tlsv1.2 --fail-with-body \ -X POST "$API_BASE/memory" \ -H "Authorization: Bearer $API_KEY" \ -H "Content-Type: application/json" \ --data "$PAYLOAD" ``` 3. If plaintext HTTP is required for local development, require an explicit opt-in such as `AGENTMM_ALLOW_INSECURE_HTTP=1`, display a prominent warning, and preferably restrict it to loopback destinations. 4. Apply the same centralized URL validation to every API script so that individual commands cannot diverge in security behavior. 5. Update the documentation to state the enforced transport requirements and avoid claiming HTTPS protection when a custom plaintext endpoint is permitted. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/forget_memory.sh:36

Finding

Unencoded User Input Permits HTTP Query-Parameter Injection

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (31)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The documentation states the skill is for memory and logging, but it also declares use of /me and an additional configurable API base not clearly reflected in the core purpose statement. This mismatch reduces transparency for reviewers and users, which can conceal extra network behavior or broaden trust assumptions around where authenticated requests are sent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence

Finding

The documentation states the skill is for memory and logging, but it also declares use of /me and an additional configurable API base not clearly reflected in the core purpose statement. This mismatch reduces transparency for reviewers and users, which can conceal extra network behavior or broaden trust assumptions around where authenticated requests are sent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The example command stores a preference stating "用户偏好中文回复" (the user prefers Chinese responses), which imposes a specific language preference in the skill documentation without indicating that this is optional or user-selected. Under the language/locale policy, documentation should not present a forced language choice unless it is clearly opt-in or justified.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill advertises executable scripts and shell-based behavior but does not declare any explicit tool scope such as permissions or allowed-tools. In agent environments, this can lead to over-broad execution authority and make it easier for the skill to invoke shell actions beyond what a reviewer expects.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The trigger description includes broad phrases like remembering information, recalling memories, or recording logs, which are common in normal conversation. In autonomous agent systems, that can cause unintended invocation and accidental transmission of user data to the external service without sufficiently specific user intent.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 79% confidence

Finding

The skill is built around persistent memory and log retention, which creates session persistence by design. In security terms, persisted logs and memories can accumulate sensitive conversational or operational data beyond the current session, increasing the blast radius of compromise or unintended disclosure.

Content

Scanner excerpt · SKILL.md (reported line 132)May include surrounding context.

md

export AGENTMM_API_KEY="amm_sk_your_key"

# 写入日志
./scripts/agentmm log write --level info --title "任务完成" --content "详细过程" --task-id task_abc

# 查询日志
./scripts/agentmm log list --level error --limit 20

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The skill is explicitly designed to send memory contents, tags, context, and other user-provided data to a remote HTTPS service. While this is documented functionality rather than covert exfiltration, it is still a genuine external transmission risk because sensitive user data leaves the local environment and is persistently stored by a third party.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

md

| 端点 | 方法 | 发送数据 | 说明 |
|---|---|---|---|
| `https://api.agentmm.site/memory` | GET / POST / DELETE | key, content, tags, context | 读写/删除记忆 |
| `https://api.agentmm.site/memory/search` | POST | query, limit, threshold | 关键词搜索记忆 |
| `https://api.agentmm.site/memory/changes` | GET | since, limit, offset | 增量同步记忆变更 |
| `https://api.agentmm.site/memory/stats` | GET | — | 记忆库统计 |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

The skill sends log records, including title, content, and metadata, to an external service over the network. Logs frequently contain operational details, identifiers, or sensitive fragments, so this creates a real confidentiality and privacy exposure even if the transfer is disclosed.

Content

Scanner excerpt · SKILL.md (reported line 167)May include surrounding context.

md

| 端点 | 方法 | 发送数据 | 说明 |
|---|---|---|---|
| `https://api.agentmm.site/memory` | GET / POST / DELETE | key, content, tags, context | 读写/删除记忆 |
| `https://api.agentmm.site/memory/search` | POST | query, limit, threshold | 关键词搜索记忆 |
| `https://api.agentmm.site/memory/changes` | GET | since, limit, offset | 增量同步记忆变更 |
| `https://api.agentmm.site/memory/stats` | GET | — | 记忆库统计 |
| `https://api.agentmm.site/log` | POST | level, title, content, metadata | 写入日志 |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

The listed endpoints continue the same remote data-sharing pattern for memory changes and log-related operations. Even read/query functions can disclose sensitive context or metadata to the remote service and reveal usage patterns tied to the agent.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

md

|---|---|---|---|
| `https://api.agentmm.site/memory` | GET / POST / DELETE | key, content, tags, context | 读写/删除记忆 |
| `https://api.agentmm.site/memory/search` | POST | query, limit, threshold | 关键词搜索记忆 |
| `https://api.agentmm.site/memory/changes` | GET | since, limit, offset | 增量同步记忆变更 |
| `https://api.agentmm.site/memory/stats` | GET | — | 记忆库统计 |
| `https://api.agentmm.site/log` | POST | level, title, content, metadata | 写入日志 |
| `https://api.agentmm.site/log/list` | GET | level, category, task_id, since, limit | 查询日志 |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 93% confidence

Finding

Remote log statistics and related API calls expose behavioral telemetry to the service provider. Although lower risk than raw content uploads, telemetry can still reveal operational cadence, errors, and task patterns that may be sensitive in aggregate.

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md

| `https://api.agentmm.site/memory` | GET / POST / DELETE | key, content, tags, context | 读写/删除记忆 |
| `https://api.agentmm.site/memory/search` | POST | query, limit, threshold | 关键词搜索记忆 |
| `https://api.agentmm.site/memory/changes` | GET | since, limit, offset | 增量同步记忆变更 |
| `https://api.agentmm.site/memory/stats` | GET | — | 记忆库统计 |
| `https://api.agentmm.site/log` | POST | level, title, content, metadata | 写入日志 |
| `https://api.agentmm.site/log/list` | GET | level, category, task_id, since, limit | 查询日志 |
| `https://api.agentmm.site/log/stats` | GET | since | 日志统计 |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 86% confidence

Finding

The /me endpoint is unrelated to core memory/log handling and introduces additional authenticated data retrieval about the agent or account. This broadens the data surface and trust boundary without a clearly justified operational need in the skill description.

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md

| `https://api.agentmm.site/memory/search` | POST | query, limit, threshold | 关键词搜索记忆 |
| `https://api.agentmm.site/memory/changes` | GET | since, limit, offset | 增量同步记忆变更 |
| `https://api.agentmm.site/memory/stats` | GET | — | 记忆库统计 |
| `https://api.agentmm.site/log` | POST | level, title, content, metadata | 写入日志 |
| `https://api.agentmm.site/log/list` | GET | level, category, task_id, since, limit | 查询日志 |
| `https://api.agentmm.site/log/stats` | GET | since | 日志统计 |
| `https://api.agentmm.site/me` | GET | — | 查询 Agent 信息 |

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 89% confidence

Finding

The endpoint list and note about remote requests confirm that the skill routinely transmits data off-host to a third-party service. In the context of a memory skill, the data is especially sensitive because it is intended to persist user and agent knowledge over time.

Content

Scanner excerpt · SKILL.md (reported line 172)May include surrounding context.

md

| `https://api.agentmm.site/memory/stats` | GET | — | 记忆库统计 |
| `https://api.agentmm.site/log` | POST | level, title, content, metadata | 写入日志 |
| `https://api.agentmm.site/log/list` | GET | level, category, task_id, since, limit | 查询日志 |
| `https://api.agentmm.site/log/stats` | GET | since | 日志统计 |
| `https://api.agentmm.site/me` | GET | — | 查询 Agent 信息 |
| `https://api.agentmm.site/server/time` | GET | — | 健康检查（无需认证）|

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

The statement that AGENTMM_API_BASE may point to a self-deployed instance means the destination host is configurable, expanding the exfiltration surface beyond the default domain. If an attacker can influence environment variables or deployment configuration, authenticated data and bearer tokens could be redirected to an untrusted endpoint.

Content

Scanner excerpt · SKILL.md (reported line 173)May include surrounding context.

md

| `https://api.agentmm.site/log` | POST | level, title, content, metadata | 写入日志 |
| `https://api.agentmm.site/log/list` | GET | level, category, task_id, since, limit | 查询日志 |
| `https://api.agentmm.site/log/stats` | GET | since | 日志统计 |
| `https://api.agentmm.site/me` | GET | — | 查询 Agent 信息 |
| `https://api.agentmm.site/server/time` | GET | — | 健康检查（无需认证）|

**不调用任何其他外部 URL。** 如果你的 `AGENTMM_API_BASE` 指向自部署实例，则请求会发往该地址而非上述默认地址。

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 84% confidence

Finding

A configurable API base combined with authenticated network access creates a meaningful risk of destination manipulation. In an agent context, this is more dangerous because the skill may be auto-invoked and send memory or logs without the user manually inspecting the active endpoint each time.

Content

Scanner excerpt · SKILL.md (reported line 174)May include surrounding context.

md

| `https://api.agentmm.site/log/list` | GET | level, category, task_id, since, limit | 查询日志 |
| `https://api.agentmm.site/log/stats` | GET | since | 日志统计 |
| `https://api.agentmm.site/me` | GET | — | 查询 Agent 信息 |
| `https://api.agentmm.site/server/time` | GET | — | 健康检查（无需认证）|

**不调用任何其他外部 URL。** 如果你的 `AGENTMM_API_BASE` 指向自部署实例，则请求会发往该地址而非上述默认地址。

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This shell script makes an external HTTP request and sends the AGENTMM_API_KEY as a Bearer token, which is a safety-relevant operation under the missing-warning rule for code files. Although the header comments document the endpoint and environment variables for readers of the source, there is no runtime confirmation, user-facing log, or explicit warning to users invoking the script that credentials will be sent to a remote service.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 70% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_memory.sh (reported line 62)May include surrounding context.

sh

PAYLOAD=$(echo "$PAYLOAD" | jq '. + {fuzzy: true}')
fi

curl -s -X POST "$API_BASE/memory/search" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD" | jq .

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 88% confidence

Finding

This script transmits user-supplied memory content, tags, and context, along with a bearer token, to an external service over the network. In the context of a persistent memory/logging skill, that behavior is expected, but it still creates a real data-exfiltration and secret-handling risk if the endpoint is misconfigured via AGENTMM_API_BASE, if sensitive data is sent without consent, or if the service is not fully trusted.

Content

Scanner excerpt · scripts/update_memory.sh (reported line 49)May include surrounding context.

sh

fi
[[ -n "${CONTEXT_VAL:-}" ]] && PAYLOAD=$(echo "$PAYLOAD" | jq --arg ctx "$CONTEXT_VAL" '. + {context: $ctx}')

curl -s -X POST "$API_BASE/memory" \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d "$PAYLOAD" | jq .

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md

#
# SECURITY MANIFEST:
#   Environment variables accessed: AGENTMM_API_KEY, AGENTMM_API_BASE (only)
#   External endpoints called: https://api.agentmm.site/memory (POST, only)
#   Local files read: none
#   Local files written: none
set -euo pipefail

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/forget_memory.sh (reported line 7)May include surrounding context.

sh

#
# SECURITY MANIFEST:
#   Environment variables accessed: AGENTMM_API_KEY, AGENTMM_API_BASE (only)
#   External endpoints called: https://api.agentmm.site/memory (POST, only)
#   Local files read: none
#   Local files written: none
set -euo pipefail

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get_me.sh (reported line 7)May include surrounding context.

sh

#
# SECURITY MANIFEST:
#   Environment variables accessed: AGENTMM_API_KEY, AGENTMM_API_BASE (only)
#   External endpoints called: https://api.agentmm.site/memory (POST, only)
#   Local files read: none
#   Local files written: none
set -euo pipefail

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/get_memory_stats.sh (reported line 7)May include surrounding context.

sh

#
# SECURITY MANIFEST:
#   Environment variables accessed: AGENTMM_API_KEY, AGENTMM_API_BASE (only)
#   External endpoints called: https://api.agentmm.site/memory (POST, only)
#   Local files read: none
#   Local files written: none
set -euo pipefail

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/read_memory.sh (reported line 7)May include surrounding context.

sh

#
# SECURITY MANIFEST:
#   Environment variables accessed: AGENTMM_API_KEY, AGENTMM_API_BASE (only)
#   External endpoints called: https://api.agentmm.site/memory (POST, only)
#   Local files read: none
#   Local files written: none
set -euo pipefail

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/search_memory.sh (reported line 7)May include surrounding context.

sh

#
# SECURITY MANIFEST:
#   Environment variables accessed: AGENTMM_API_KEY, AGENTMM_API_BASE (only)
#   External endpoints called: https://api.agentmm.site/memory (POST, only)
#   Local files read: none
#   Local files written: none
set -euo pipefail

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/sync_daemon.sh (reported line 10)May include surrounding context.

sh

#
# SECURITY MANIFEST:
#   Environment variables accessed: AGENTMM_API_KEY, AGENTMM_API_BASE (only)
#   External endpoints called: https://api.agentmm.site/memory (POST, only)
#   Local files read: none
#   Local files written: none
set -euo pipefail

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · scripts/update_memory.sh (reported line 7)May include surrounding context.

sh

#
# SECURITY MANIFEST:
#   Environment variables accessed: AGENTMM_API_KEY, AGENTMM_API_BASE (only)
#   External endpoints called: https://api.agentmm.site/memory (POST, only)
#   Local files read: none
#   Local files written: none
set -euo pipefail