ClawHub
Back to skill

Security audit

Agentmemo

Security checks for vulnerabilities and agentic risk

Overview

The skill clearly discloses that it sends agent memories to AgentMemo's cloud service, but its optional MCP setup runs an unpinned npm package with the user's API key.

Install only if you are comfortable storing selected agent memories with AgentMemo and passing an AgentMemo API key to its tools. Prefer pinning the npm packages to reviewed exact versions, restrict the MCP process environment to only the required API key, and avoid storing secrets, private credentials, or sensitive personal data as memories.

A.I.G

Vulnerability Patterns
  • Insecure DependenciesIntroduces malicious components through unsafe dependency sources
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T08 · Insecure Dependencies

Warning
Location
SKILL.md:83
Finding
Unpinned npm Packages Permit Unreviewed Supply-Chain Code Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:28-34`, `SKILL.md:83-95`, `SKILL.md:136-140` **Vulnerability Type**: Unpinned third-party package installation and execution **Risk Level**: Medium The Skill recommends installing or directly executing npm packages without specifying reviewed versions or integrity constraints. ```json "install": [ { "id": "agentmemo-mcp", "kind": "node", "package": "agentmemo-mcp", "bins": ["agentmemo-mcp"], "label": "AgentMemo MCP server (optional — for MCP clients only)", "optional": true, }, ], ``` ```json { "mcpServers": { "agentmemo": { "command": "npx", "args": ["agentmemo-mcp"], "env": { "AGENTMEMO_API_KEY": "your_api_key_here" } } } } ``` ```bash npm install agentmemo ``` ### Technical Analysis Running `npx agentmemo-mcp` without an exact version can cause npm to retrieve and execute the version currently selected by the package registry. Similarly, `npm install agentmemo` installs the package version selected by npm's dependency resolution at installation time. Neither command provides a version pin, lockfile, package integrity hash, or other mechanism tying installation to an audited artifact. The effective executable code can therefore change after this Skill has been reviewed. If the package, its publishing account, the registry delivery path, or a transitive dependency is compromised, a malicious release could execute with the permissions of the user running the MCP client. The MCP configuration also explicitly supplies `AGENTMEMO_API_KEY` to the child process. A malicious or compromised `agentmemo-mcp` release could read and exfiltrate that credential. Depending on the runtime environment, it could also access other inherited environment variables, user-readable files, network resources, and any capabilities available to the MCP process. This is classified as **T08: Insecure Dependencies** because the exposure originates ...[truncated 1790 chars]
Remediation
<![CDATA[ ## Remediation Suggestions 1. Pin every referenced npm package to an exact, reviewed version, for example: ```json { "command": "npx", "args": ["--yes", "--package", "agentmemo-mcp@1.2.3", "agentmemo-mcp"] } ``` 2. Pin the SDK installation similarly: ```bash npm install --save-exact agentmemo@1.2.3 ``` 3. Commit and enforce an npm lockfile where applicable. Use `npm ci` rather than unconstrained installation in automated environments. 4. Verify package provenance and registry integrity metadata before deployment. Review package contents, lifecycle scripts, maintainers, and transitive dependencies for each upgrade. 5. Disable npm lifecycle scripts during installation where they are unnecessary: ```bash npm install --ignore-scripts --save-exact agentmemo@1.2.3 ``` Only use this control if the reviewed package does not legitimately require installation scripts. 6. Run the MCP server in a restricted environment with access only to the required API key and network destination. Avoid inheriting unrelated secrets, restrict filesystem access, and apply process sandboxing where supported. 7. Establish an explicit upgrade process so package-version changes trigger dependency review, integrity verification, and renewed security testing before deployment. ]]>

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Findings (5)

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Store a memory
curl -X POST https://api.agentmemo.net/memories \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content": "User prefers dark mode and compact layouts", "namespace": "preferences"}'
Confidence
60% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Store a memory
curl -X POST https://api.agentmemo.net/memories \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content": "User prefers dark mode and compact layouts", "namespace": "preferences"}'
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Store a memory
curl -X POST https://api.agentmemo.net/memories \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content": "User prefers dark mode and compact layouts", "namespace": "preferences"}'
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

External Transmission

Medium
Category
Data Exfiltration
Content
```bash
# Store a memory
curl -X POST https://api.agentmemo.net/memories \
  -H "X-API-Key: YOUR_KEY" \
  -H "Content-Type: application/json" \
  -d '{"content": "User prefers dark mode and compact layouts", "namespace": "preferences"}'
Confidence
50% confidence
Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Rp1

Medium
Category
MCP Rug Pull
Confidence
90% confidence
Finding
The skill instructs users to launch an MCP server via `npx agentmemo-mcp` without pinning an exact version. This creates a supply-chain risk: a future compromised or malicious package release could be fetched and executed automatically in the agent environment, potentially with access to API keys and local context.

Static analysis

No suspicious patterns detected.