Pgmemory

• Outcome: Review
• Latest audit: May 29, 2026 · 9:22 PM UTC
• Version: 1.2.0

Overview

This skill appears to provide real persistent memory functionality, but its setup can make broad, lasting host and agent-environment changes that users should review before installing.

Install only if you are comfortable with a persistent memory system that may run a local database, modify AGENTS.md, and send memory text to the configured embedding provider. Avoid storing secrets or regulated data, prefer Ollama/local embeddings for sensitive projects, protect pgmemory.json if it contains an API key, review any AGENTS.md changes, and do not run setup.py --yes unless you accept possible Docker installation and host configuration changes.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (19)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

subprocess.run(["sudo","systemctl","enable","--now","docker"], capture_output=True)
        user = os.environ.get("USER","")
        if user:
            subprocess.run(["sudo","usermod","-aG","docker",user], capture_output=True)
            warn(f"Added {user} to docker group — re-login for this to take effect")
        ok("Docker installed"); return True
    elif system == "darwin":

• Confidence: 85% confidence
• Finding: subprocess.run(["sudo","usermod","-aG","docker",user], capture_output=True)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

system = platform.system().lower()
    if system == "linux":
        if not yes and input("  Install Docker via get.docker.com? [y/n] ").lower() != "y": return False
        if subprocess.run("curl -fsSL https://get.docker.com | sh", shell=True).returncode != 0:
            err("Docker install failed"); return False
        subprocess.run(["sudo","systemctl","enable","--now","docker"], capture_output=True)
        user = os.environ.get("USER","")

• Confidence: 99% confidence
• Finding: if subprocess.run("curl -fsSL https://get.docker.com | sh", shell=True).returncode != 0:

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

try:
            existing_cron = subprocess.run(["crontab","-l"], capture_output=True, text=True).stdout
            if "pgmemory" not in existing_cron:
                proc = subprocess.run(["crontab","-"], input=existing_cron.rstrip()+"\n"+decay_cmd+"\n",
                                      text=True, capture_output=True)
                if proc.returncode == 0: ok("Cron job added")
                else: warn(f"Could not add cron: {proc.stderr}")

• Confidence: 93% confidence
• Finding: proc = subprocess.run(["crontab","-"], input=existing_cron.rstrip()+"\n"+decay_cmd+"\n", text=True, capture_output=True)

Tainted flow: 'user' from os.environ.get (line 480, credential/environment) → subprocess.run (code execution)

Medium

• Category: Data Flow

Content

subprocess.run(["sudo","systemctl","enable","--now","docker"], capture_output=True)
        user = os.environ.get("USER","")
        if user:
            subprocess.run(["sudo","usermod","-aG","docker",user], capture_output=True)
            warn(f"Added {user} to docker group — re-login for this to take effect")
        ok("Docker installed"); return True
    elif system == "darwin":

• Confidence: 87% confidence
• Finding: subprocess.run(["sudo","usermod","-aG","docker",user], capture_output=True)

Tainted flow: 'agents_md' from os.environ.get (line 899, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

injected = inject_startup_into_agents_md(agents_md, agent_id, config)
            if injected:
                ok(f"{agent_id}: startup steps injected into 'Every Session' list")
            with open(agents_md, "a") as f: f.write(section)
        else:
            agents_md.parent.mkdir(parents=True, exist_ok=True)
            agents_md.write_text(section)

• Confidence: 84% confidence
• Finding: with open(agents_md, "a") as f: f.write(section)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 89% confidence
• Finding: The skill advertises significant capabilities (environment access, file read/write, network, and shell) but does not declare permissions or prominently disclose them. This creates a trust and consent problem: users may run setup and maintenance commands that modify the host, contact external services, and access sensitive local state without an explicit permission boundary.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The documented purpose suggests a memory skill, but the described setup also installs or manages Docker/PostgreSQL, edits AGENTS.md across workspaces, syncs configuration into multiple agent environments, adds cron jobs, and runs migrations. That gap is security-relevant because users may authorize a seemingly narrow skill while it performs broad system administration and persistence actions affecting multiple projects and future execution contexts.

Context-Inappropriate Capability

Medium

• Confidence: 98% confidence
• Finding: The changelog explicitly describes persisting the embedding API key in `pgmemory.json` and preferring that stored secret over environment variables. Persisting API credentials in a general config file materially increases secret exposure through repo commits, backups, workspace sharing, logs, and downstream agent/tool access, which is outside the core memory-storage purpose and creates a real credential-handling risk.

Description-Behavior Mismatch

Medium

• Confidence: 87% confidence
• Finding: The script is presented as a query/search and inspection tool, but it also exposes --restore and --harvest operations that modify persistent memory state. In an agent-tooling context, misleading affordances are dangerous because higher-level agents or users may invoke a seemingly read-only tool and unintentionally alter durable state, enabling integrity issues and unsafe privilege expansion.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The setup script can install Docker, enable services, and modify Docker group membership on the host. For a PostgreSQL-backed memory skill, these are excessive capabilities that materially expand attack surface and system impact; combined with the remote install script they enable arbitrary host changes far beyond necessary setup.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The script persists a recurring cron job to run itself daily. Background persistence is not necessary for the core purpose of semantic memory setup and increases risk because it silently creates ongoing execution behavior on the user's machine.

Context-Inappropriate Capability

Medium

• Confidence: 94% confidence
• Finding: The sync feature enumerates OpenClaw agent workspaces and rewrites `AGENTS.md` across them, extending the tool's influence into multiple local projects. This broad file-modification capability is disproportionate to the stated memory backend function and becomes more dangerous because it can be steered by local config/environment state.

Natural-Language Policy Violations

Medium

• Confidence: 86% confidence
• Finding: The changelog says AGENTS.md integration is 'startup-mandatory' and that agents should run memory queries before every task, reducing user control over agent behavior. In an agent skill context, forcibly inserting persistent behavior into startup flows can expand data access and execution scope without explicit per-workspace consent, making misuse or overcollection more likely.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The README documents third-party embedding providers but does not warn that memory contents may be sent to those external services for embedding generation. In this skill’s context, users are explicitly encouraged to store infrastructure details, constraints, and other persistent operational knowledge, so omission of a privacy warning can lead to accidental disclosure of sensitive data to external vendors.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill encourages storing decisions, constraints, infrastructure facts, and discoveries persistently, and its config shows use of an external embedding provider. Without a clear warning, users may place secrets, internal architecture details, customer data, or other sensitive project context into PostgreSQL and potentially transmit that content to third-party embedding services.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The wizard may store the embedding provider API key directly in the JSON config file, but does not present a clear explicit warning at the point of save about storing a secret on disk. This can lead to accidental credential exposure through backups, loose file permissions, or repository inclusion.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: In `--yes` mode the script can auto-approve downloading and executing Docker's remote install script, then perform privileged service changes, without a strong just-in-time warning. Non-interactive acceptance of such invasive actions is especially unsafe because users may not realize a memory setup tool will alter the host this extensively.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The wizard appends or creates `AGENTS.md` content automatically, and in `--yes` mode this can occur without an interactive warning at the moment files are changed. Silent modification of workspace instructions is risky because it changes agent behavior and local project files in a way users may not anticipate from setup.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

psycopg2-binary>=2.9

• Confidence: 93% confidence
• Finding: psycopg2-binary>=2.9

VirusTotal

66/66 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.