Auto Memory

• Outcome: Pass
• Latest audit: Sep 11, 2026 · 12:45 AM UTC
• Version: 1.1.0

Overview

This skill appears to do what it claims: store and recover agent memory through public permanent storage, with important privacy and API-key handling risks disclosed enough for user review.

Install only if you want permanent public storage for selected memories or files. Do not upload secrets, credentials, private prompts, regulated data, or personal data unless you encrypt it first. Treat the Auto Drive API key as sensitive, avoid pasting it while screen sharing or into shell history, and pin the optional npx-based auto-respawn tooling before using wallet anchoring.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup-auto-memory.sh:43
• Finding: API Key Is Echoed During Interactive Setup<![CDATA[ ## Vulnerability Details **File Location**: `scripts/setup-auto-memory.sh:43-44` **Vulnerability Type**: Interactive secret disclosure **Risk Level**: Medium ### Vulnerable Code ```bash read -rp "Paste your API key here: " API_KEY API_KEY="${API_KEY//[[:space:]]/}" ``` ### Technical Analysis The `read` command does not use silent mode (`-s`). Consequently, the API key is displayed as the user types or pastes it. Although transmitting the key to the Auto Drive API is necessary for authentication, exposing it in terminal output is not necessary for the Skill’s declared functionality. The key may be captured by shoulder surfing, terminal session recording, screen sharing, support logs, or automation that records terminal output. ### Attack Path 1. A user runs `scripts/setup-auto-memory.sh`. 2. The script prompts the user to paste an Auto Drive API key. 3. The terminal displays the complete key. 4. A local observer, screen-sharing participant, or terminal-recording system captures it. 5. The attacker uses the stolen key against Auto Drive API endpoints. ### Impact Assessment A captured key can provide access to the victim’s Auto Drive account capabilities, including authenticated uploads and consumption of the victim’s storage quota. The exact scope depends on the permissions assigned to the API key. This issue does not itself provide operating-system privilege escalation. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions Use silent input for secrets and explicitly print a newline afterward: ```bash read -rsp "Paste your API key here: " API_KEY printf '\n' API_KEY="${API_KEY//[[:space:]]/}" ``` Additionally: - Avoid logging the variable or commands containing it. - Clear the variable with `unset API_KEY` after verification and persistence. - Warn users not to paste the key while screen sharing or recording a terminal. - Prefer integration with an operating-system credential store where supported. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/update-api-key.sh:17
• Finding: API Key Rotation Accepts Secrets Through Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `scripts/update-api-key.sh:17-24` **Vulnerability Type**: Secret exposure through process arguments and terminal input **Risk Level**: Medium ### Vulnerable Code ```bash if [[ -n "${1:-}" ]]; then API_KEY="$1" elif [[ -t 0 ]]; then read -rp "New Auto Drive API key: " API_KEY elif [[ -n "${AUTO_DRIVE_API_KEY:-}" ]]; then API_KEY="$AUTO_DRIVE_API_KEY" else echo -e "${RED}Error: No API key provided (non-interactive and AUTO_DRIVE_API_KEY is unset).${NC}" >&2 exit 1 fi ``` ### Technical Analysis The script accepts an API key as its first command-line argument. Command-line arguments commonly remain in shell history and may be visible to local process-inspection tools while the command is running. The interactive fallback also uses an echoing `read` command rather than silent input. Passing credentials through command arguments is unnecessary because protected standard input, a dedicated file descriptor, or a secret manager can provide non-interactive input without placing the value in the command line. ### Attack Path 1. A user runs a command such as: ```bash scripts/update-api-key.sh actual-secret-key ``` 2. The command and key may be written to shell history. 3. While the process is running, another local process may inspect its argument list where platform permissions allow. 4. An attacker with access to the user’s history, process metadata, terminal logs, or CI command logs recovers the key. 5. The attacker reuses the key against the Auto Drive API. Alternatively, when the user runs the script interactively without an argument, the prompt visibly echoes the key and exposes it to terminal observers. ### Impact Assessment The vulnerability may disclose the Auto Drive API credential to local users or logging infrastructure. A stolen key can permit authenticated Auto Drive operations within the key’s assigned scope and can consume the account’s upload allowance. It does not indepe ...[truncated 57 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Remove support for API keys supplied as ordinary command-line arguments. For interactive use, read the key silently: ```bash if [[ -t 0 ]]; then read -rsp "New Auto Drive API key: " API_KEY printf '\n' elif [[ -n "${AUTO_DRIVE_API_KEY:-}" ]]; then API_KEY="$AUTO_DRIVE_API_KEY" else echo "Error: No API key supplied through a protected input mechanism." >&2 exit 1 fi ``` For automation: - Read from a protected file descriptor or standard input. - Use the CI platform’s masked secret facility. - Avoid command tracing while handling credentials. - Clear temporary secret variables after use. - Document that command-line arguments must never contain API keys. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/automemory-download.sh:27
• Finding: Download Destination Validation Can Be Bypassed with a Final-Component Symlink<![CDATA[ ## Vulnerability Details **File Location**: `scripts/automemory-download.sh:27-40,45-49` **Vulnerability Type**: Symlink-following arbitrary file overwrite **Risk Level**: Medium ### Vulnerable Code ```bash if [[ -n "$OUTPUT" ]]; then if [[ "$OUTPUT" == *..* ]]; then echo "Error: Output path must not contain '..': $OUTPUT" >&2; exit 1 fi OUTPUT_DIR_PART="$(dirname "$OUTPUT")" OUTPUT_BASE="$(basename "$OUTPUT")" OUTPUT_RESOLVED="$(cd "$OUTPUT_DIR_PART" 2>/dev/null && pwd -P)/$OUTPUT_BASE" || { echo "Error: Could not resolve output path — directory does not exist: $OUTPUT_DIR_PART" >&2; exit 1 } HOME_REAL="$(cd "$HOME" && pwd -P)" if [[ "$OUTPUT_RESOLVED" != "$HOME_REAL/"* ]]; then echo "Error: Output path must be within home directory" >&2 exit 1 fi OUTPUT="$OUTPUT_RESOLVED" fi ``` The validated path is subsequently passed directly to `curl`: ```bash download_to_file() { local URL="$1" DEST="$2" shift 2 RESPONSE=$(curl -sS -w "\n%{http_code}" "$URL" "$@" -o "$DEST") echo "$RESPONSE" | tail -1 } ``` ### Technical Analysis The validation physically resolves only the destination’s parent directory. It appends the final basename without checking whether that final path component is an existing symbolic link. `curl -o` follows symbolic links when opening the destination. Therefore, a path that syntactically resides beneath `$HOME` can point to another writable file outside `$HOME`. This bypasses the script’s intended home-directory write boundary. The vulnerability is a time-of-check/time-of-use concern as well: even if the destination were checked once, another local actor could replace it with a symlink before `curl` opens it. ### Attack Path 1. An attacker who can create files in a directory beneath the victim’s home directory creates a symlink: ```bash ln -s /path/to/another/writable/file "$HOME/download-result" ``` 2. The victim invokes: ```bash scripts/automemory-download.sh <val ...[truncated 893 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Implement all of the following safeguards: 1. Reject an existing destination symlink: ```bash if [[ -L "$OUTPUT" ]]; then echo "Error: Output path must not be a symbolic link" >&2 exit 1 fi ``` 2. Write into a securely created temporary file inside the already validated directory: ```bash TMP_OUTPUT=$(mktemp "$OUTPUT_DIR_PART/.automemory-download.XXXXXX") chmod 600 "$TMP_OUTPUT" ``` 3. Download to the temporary file, validate the HTTP result, and atomically rename it to the destination. 4. Recheck the destination immediately before replacement. 5. Refuse to overwrite existing files by default; require an explicit `--force` option if overwrite is intended. 6. Where available, use an implementation that opens the destination with no-follow and exclusive-creation semantics. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:233
• Finding: Optional Wallet Integration Uses an Unpinned Package Through npx<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:233-239` **Vulnerability Type**: Unpinned remote dependency execution **Risk Level**: Medium ### Vulnerable Code ```bash After each `automemory-save-memory.sh` call, run: ```bash npx tsx auto-respawn.ts anchor --from <wallet-name> --cid <new-cid> ``` ``` ### Technical Analysis The documented integration invokes `npx tsx` without specifying a package version, lockfile, integrity value, or verified local installation. If `tsx` is not already installed locally, `npx` may retrieve and execute a package from the configured npm registry at invocation time. This creates a supply-chain execution path whose effective code can change after the Skill has been reviewed. The command is especially sensitive because it is documented for an on-chain wallet operation. While the repository itself does not contain a malicious package or remote shell payload, the instruction unnecessarily relies on mutable external package resolution. ### Attack Path 1. A user follows the documented Auto-Respawn integration. 2. The local project does not contain a locked and verified `tsx` installation. 3. `npx` resolves the package from the configured registry. 4. A compromised registry account, malicious package release, registry substitution, or dependency compromise supplies attacker-controlled code. 5. The downloaded package executes with the user’s privileges. 6. The code may access environment variables, local files, or wallet-related resources available to that process. This path depends on compromise or malicious control of the resolved package or registry; the audit found no evidence that the current legitimate `tsx` package is malicious. ### Impact Assessment Compromised dependency code would execute with the privileges of the user running `npx`. It could read accessible files and environment variables, alter workspace content, or interfere with the wallet anchoring operation. Any wallet impact depends on how `a ...[truncated 104 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Pin and lock the dependency before use: ```json { "devDependencies": { "tsx": "<reviewed-exact-version>" } } ``` Then: - Commit a package lockfile containing registry integrity metadata. - Install with a lockfile-enforcing command such as `npm ci`. - Invoke the verified local executable rather than allowing dynamic resolution: ```bash ./node_modules/.bin/tsx auto-respawn.ts anchor --from <wallet-name> --cid <new-cid> ``` - Review and pin the companion `auto-respawn.ts` implementation. - Use a trusted registry and restrict package installation scripts where feasible. - Run wallet-related tooling with minimal filesystem and environment access. - Require explicit user confirmation before signing an on-chain transaction. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (30)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description promises persistent agent-memory functionality on the Autonomys Network, including saving decisions/context and rebuilding history from a CID after state loss. This code chunk does not implement those behaviors. Instead, it contains support/setup logic: dependency checks, CID regex validation, API-key verification with the Auto Drive service, and local credential/config persistence. Those are materially different from the advertised primary purpose. While helper/setup code can be related, this chunk lacks any actual memory-chain upload, retrieval, or reconstruction logic, and it performs an undeclared credential-handling capability.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The description promises a durable agent-memory system that saves decisions, identity, and context and can reconstruct full history from a CID. The supplied code does not implement saving, memory chaining, identity/context handling, or history reconstruction. It only validates a CID and downloads the corresponding file from Autonomys endpoints, writing it to stdout or a local file. This is a materially different primary purpose. The optional use of an API key for authenticated downloads also touches external access not reflected in the declared permissions, though the main mismatch is the gap between claimed memory functionality and actual file-download behavior.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The declared description presents a broader system capability centered on durable storage and recovery of agent memory on the Autonomys Network. The supplied code chunk is specifically a recall utility: it accepts or discovers a CID, validates it, downloads each linked memory item via API or public gateway, optionally decompresses content, prints or saves JSON files, follows previousCid links, and optionally rewrites a local automemory state file. That is only the retrieval/restoration portion of the described system, not the permanent storage portion. The code does not upload, save, or persist memories to the network, nor does it reconstruct full agent identity/context except by outputting fetched entries. Because the primary declared purpose combines storage and guaranteed persistence, while the actual script is a limited chain-fetch/restore tool with local file writes, this is a material description-behavior mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The code is a generic uploader for a single file to Auto Drive. It authenticates with an API key, creates an upload, sends one file chunk, completes the upload, validates the returned CID, and prints the CID/gateway URL. While this may be a building block for storage on Autonomys-related infrastructure, it does not implement the declared higher-level behavior of permanent agent memory, chaining memory entries, preserving identity/context, or reconstructing history after state loss. The description materially overstates the actual behavior, so this is a mismatch.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence
• Finding: The declared description is about a memory persistence capability: saving agent state/history to the Autonomys Network and rebuilding history from a CID. The supplied code does not implement memory saving, retrieval, chain reconstruction, or CID-based recovery. Instead, it performs initial service configuration by directing the user to create an API key, collecting that credential, saving it locally, and verifying the key. While this may support the broader memory feature, the chunk’s actual primary purpose is setup and credential management, which is materially different from the declared end-user functionality.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 99% confidence
• Finding: The declared description is about durable agent-memory storage and recovery on the Autonomys Network. The actual code does not implement memory storage, recovery, CID handling, identity/context persistence, or network-based history reconstruction. Instead, it performs credential management: it reads a new API key, validates it, saves it, and tells the user to restart a gateway. This is a materially different primary purpose and introduces an undeclared capability related to secret/API key handling.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared description presents a core memory-storage and history-reconstruction capability on the Autonomys Network. The supplied code does not store memory, rebuild history, manage CIDs, or implement persistence logic. Instead, it is an operational verification script for setup readiness: it checks local prerequisites, validates an API key, and displays account upload limits and usage. These are materially different primary behaviors from the declared purpose, so this is a clear description-behavior mismatch.

Ae1

High

• Category: analysis-evasion

Content

scripts/automemory-recall-chain.sh [cid] [--limit N] [--output-dir DIR]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Ae1

High

• Category: analysis-evasion

Content

scripts/automemory-recall-chain.sh [cid] [--limit N] [--output-dir DIR]

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'shell' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Credential Access

High

• Category: Privilege Escalation

Content

AD_BASE_URL="https://mainnet.auto-drive.autonomys.xyz/api"
AD_DOWNLOAD_URL="https://public.auto-drive.autonomys.xyz/api"
AM_OPENCLAW_DIR="${OPENCLAW_DIR:-$HOME/.openclaw}"
AM_ENV_FILE="$AM_OPENCLAW_DIR/.env"
AM_CONFIG_FILE="$AM_OPENCLAW_DIR/openclaw.json"

GREEN='\033[0;32m'

• Confidence: 89% confidence
• Finding: The script is designed to persist an API key in plaintext within `$HOME/.openclaw/.env`, creating a durable secret at a predictable location. Even though permissions are tightened, any compromise of the user account, unsafe backups, accidental file disclosure, or other local tooling that reads `.env` files could expose the credential.

Credential Access

High

• Category: Privilege Escalation

Content

fi
  echo -e "${GREEN}✓ Saved to $AM_CONFIG_FILE${NC}"

  # --- .env ------------------------------------------------------------------
  # Remove any existing AUTO_DRIVE_API_KEY lines first to prevent duplicates,
  # then append exactly one entry.
  if [[ -f "$AM_ENV_FILE" ]]; then

• Confidence: 90% confidence
• Finding: This block intentionally manages a `.env` file containing `AUTO_DRIVE_API_KEY`, which increases the credential exposure surface beyond process memory into persistent local storage. In the context of an agent skill that may be installed broadly, automatic secret persistence makes leakage through backups, support bundles, repo mistakes, or local compromise more likely.

Credential Access

High

• Category: Privilege Escalation

Content

sed '/^AUTO_DRIVE_API_KEY=/d' "$AM_ENV_FILE" > "$sedtmp" && mv "$sedtmp" "$AM_ENV_FILE"
  fi
  # Single-quote the value so characters like #, $, and backticks are
  # preserved literally when the .env file is later sourced by bash.
  local safe_key="${key//\'/\'\\\'\'}"
  echo "AUTO_DRIVE_API_KEY='${safe_key}'" >> "$AM_ENV_FILE"
  chmod 600 "$AM_ENV_FILE"

• Confidence: 92% confidence
• Finding: The code appends the API key directly into a shell-sourceable `.env` file, creating plaintext secret material on disk. While quoting is handled carefully to prevent shell injection, the main risk remains credential disclosure from persistent storage in a commonly targeted file format.

External Script Fetching

High

• Category: Supply Chain

Content

if [[ -n "$EXPERIENCE" ]] && echo "$EXPERIENCE" | jq empty 2>/dev/null; then
      echo "[$COUNT] Fetched $CID via gateway" >&2
    else
      # ZLIB compressed — pipe curl directly into decompressor (no intermediate variable)
      EXPERIENCE=""
      if command -v python3 &>/dev/null; then
        EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null \

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

External Script Fetching

High

• Category: Supply Chain

Content

| python3 -c "import sys,zlib;sys.stdout.buffer.write(zlib.decompress(sys.stdin.buffer.read()))" 2>/dev/null || true)
      fi
      if [[ -z "$EXPERIENCE" ]] && command -v perl &>/dev/null; then
        EXPERIENCE=$(curl -sS --fail "$GATEWAY_URL" 2>/dev/null \
          | perl -MCompress::Zlib -e 'undef $/;my $d=uncompress(<STDIN>);print $d if defined $d' 2>/dev/null || true)
      fi
      if [[ -n "$EXPERIENCE" ]]; then

• Confidence: 90% confidence
• Finding: Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.

Session Persistence

Medium

• Category: Rogue Agent

Content

license: Apache-2.0
description: Indestructible agent memory — permanently stored, never lost. Save decisions, identity, and context as a memory chain on the Autonomys Network. Rebuild your full history from a single CID, even after total state loss.
compatibility: Requires curl, jq, and the file utility, plus outbound HTTPS to the Autonomys Auto Drive API (ai3.storage) and public gateway. Stored data is permanent and public — do not store secrets. Works with OpenClaw and Hermes agents on macOS and Linux.
allowed-tools: Bash(curl:*) Bash(jq:*) Bash(file:*) Read Write
metadata:
  openclaw:
    emoji: "🧬"

• Confidence: 91% confidence
• Finding: The skill has `Write` permission and explicitly documents persistent local state updates, including writing the latest CID to a state file and modifying `MEMORY.md`. In context, this persistence is more dangerous because the skill's purpose is long-term retention and resurrection of agent context; accidental or unsafe writes can preserve sensitive data locally and make future agents trust or consume tainted history.

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The invocation guidance includes broad phrases like 'save memory', 'remember this permanently', and 'Any time the user wants data stored permanently,' which can overlap with ordinary conversational requests. In an agent environment, this increases the risk of unintentional invocation and accidental transmission of sensitive context to a permanent public storage network.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 82% confidence
• Finding: The documentation instructs users to run `npx tsx auto-respawn.ts ...` without pinning a specific package version. Unpinned `npx` execution can fetch whatever version is current at execution time, creating a supply-chain risk where a compromised or incompatible dependency is executed unexpectedly.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The document explicitly encourages storing arbitrary agent memory, including potentially full file snapshots and identity/context data, on permanent decentralized storage and describes resurrection from a single CID, but it does not warn that such data may be irreversible, publicly retrievable, and unsuitable for secrets or personal data. In the context of an agent memory skill, this omission is dangerous because operators may persist API keys, credentials, private prompts, personal data, or sensitive internal state that cannot be deleted once published.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

local key="$1"

  mkdir -p "$AM_OPENCLAW_DIR"
  chmod 700 "$AM_OPENCLAW_DIR"

  # Collect temp files for cleanup
  _AM_TMPS=()

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-memory": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AM_CONFIG_FILE"
    chmod 600 "$AM_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-memory": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AM_CONFIG_FILE"
    chmod 600 "$AM_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-memory": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AM_CONFIG_FILE"
    chmod 600 "$AM_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-memory": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AM_CONFIG_FILE"
    chmod 600 "$AM_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

jq -n --arg key "$key" \
      '{"skills": {"entries": {"auto-memory": {"enabled": true, "apiKey": $key}}}}' \
      > "$newtmp" && mv "$newtmp" "$AM_CONFIG_FILE"
    chmod 600 "$AM_CONFIG_FILE"
  else
    local jsontmp
    jsontmp=$(mktemp)

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Static analysis

No suspicious patterns detected.