Security audit
Security checks for vulnerabilities and agentic risk
The local-memory features fit the purpose, but the skill directs external diagnostic sharing without clear user control and runs unpinned downloaded code.
Keep diagnostics local unless you approve the exact report and recipient; social replies may be public. Review and pin the MCP package before giving it a memory token, and inspect the VM scripts before running them. The Review verdict reflects these concrete control gaps, not evidence of intentional malicious behavior.
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
Only for a Keephaven Agent Memory box (released 2026-10-25, for a Pi 5 or a USB SSD on a Windows PC: https://keephaven.co/agent-memory). Home and Photos boxes don't have it. Check first:
curl -s http://<box>:8790/v1/health
`{"ok": true, ...}` means it's there. No answer means this box doesn't have it.
The npx command retrieves and executes code from a mutable GitHub reference, with automatic confirmation and no immutable version pin. A compromised repository or malicious update could execute with the user's privileges and access the MCP server's environment, including its memory-access token.
The skill directs the agent to send a report and unspecified failure details to a third-party recipient without obtaining separate user approval. This crosses the local-data trust boundary emphasized by the skill, and failure details could reveal local paths, network information, or other sensitive diagnostic context.
The reporting instruction provides no privacy guidance or limits on what 'anything that broke' includes, creating a risk of disclosing sensitive diagnostics, especially through public replies. This is the same underlying disclosure issue as SDI-1, not an independent transmission mechanism.
No suspicious patterns detected.