MemoryLayer

• Outcome: Review
• Latest audit: Sep 10, 2026 · 9:31 AM UTC
• Version: 1.0.0

Overview

This is a real hosted memory client, but it asks agents to persist potentially sensitive memories remotely without enough privacy, trust-boundary, or endpoint-safety guidance.

Install only if you are comfortable sending agent memories, metadata, search queries, and credentials to the MemoryLayer service or a carefully controlled endpoint. Do not store secrets, regulated personal data, internal procedures, or tool-use instructions without a privacy review, and treat retrieved memories as untrusted context rather than commands.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: index.js:5

Finding

Credentials, bearer tokens, and memory data can be transmitted to an arbitrary insecure endpoint

Content

View full analysis

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: index.js:63

Finding

Untrusted persistent memories are inserted directly into agent prompts

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:43

Finding

Documentation recommends installing an unpinned SDK described as not yet published

Content

View full analysis

### 3. Install Python SDK (if not using skill wrapper) ```bash pip install memorylayer ``` ``` ```markdown - **Python SDK:** https://pypi.org/project/memorylayer (when published) ``` ### Technical Analysis The setup instructions direct users to install `memorylayer` from the default Python Package Index without an exact version, hash, verified publisher, or reviewed artifact reference. The same document qualifies the package link with “when published,” indicating that the documented package may not yet be an established official distribution. If the expected package name is unclaimed or users cannot distinguish the official publisher, an attacker may publish a package under that name. Unpinned installation also permits future or compromised releases to be selected automatically. Python packages can execute build or installation logic and later execute arbitrary code when imported. This finding concerns the separate SDK installation instruction. The local Python wrapper currently depends on `requests>=2.31.0`; it does not install the commented-out `memorylayer` dependency from `python/requirements.txt`. ### Attack Path 1. An attacker claims the expected `memorylayer` package name or compromises its publishing account. 2. The attacker publishes a malicious package or malicious future version. 3. A user follows the documented `pip install memorylayer` command. 4. The package manager retrieves the attacker-controlled artifact because no exact version or hash is required. 5. Malicious build or installation code executes, or the payload executes when the installed package is imported. ### Impact Assessment Malicious package code executes with the privileges of the user or automation account running `pip ...[truncated 415 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (24)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared purpose frames the skill as local semantic memory infrastructure, but the setup and links show it authenticates against a hosted service using email/password or API key and exposes account/usage operations. That mismatch can mislead users into providing sensitive memory data under the assumption it stays local, increasing the risk of unintended credential exposure and third-party data transfer.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 92% confidence

Finding

The lockfile pins axios 1.13.4, and the provided advisory set includes high-risk issues such as SSRF-related NO_PROXY bypasses and prototype-pollution-assisted MITM/credential theft scenarios. In an agent memory skill, HTTP clients often handle remote API calls and potentially sensitive tokens or memory sync traffic, so a vulnerable request library materially increases exposure.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)

High

• Category: Supply Chain
• Confidence: 87% confidence

Finding

form-data 4.0.5 is flagged for CRLF injection via unescaped multipart field names and filenames. If this skill ever constructs multipart requests from attacker-controlled inputs, the bug could enable request smuggling or header/body manipulation against downstream services.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.13.4 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

• Category: Supply Chain
• Confidence: 97% confidence

Finding

The project depends on axios, and the analysis indicates the resolved version is 1.13.4 with multiple known advisories, including SSRF/proxy-bypass and prototype-pollution-related attack chains. In an agent memory skill that likely performs network requests, vulnerable HTTP client behavior can materially increase the risk of request forgery, credential leakage, response tampering, or other compromise depending on how the library is used.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README promotes storing and semantically searching user memories, including potentially sensitive preferences and chat-derived data, but provides no privacy, retention, consent, or data-handling guidance. In an agent-memory product, this omission is risky because developers may ingest personal or confidential data into a third-party service without understanding exposure, tenancy, or compliance implications.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill advertises code examples and setup that clearly require environment secrets and outbound network access, yet the manifest does not declare any tool scope or permissions. This creates hidden capability expansion: an agent or reviewer may treat the skill as lower risk than it is, while it can send memory content and credentials to an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

This skill is explicitly designed to store and retrieve agent memories, including examples containing sensitive personal and operational information, but it does not warn that memory content and search queries may be transmitted to an external hosted service. In context, that omission is especially dangerous because users may upload confidential prompts, preferences, credentials, or operational procedures to a third party without informed consent or data-handling review.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

This example persists user-related preferences and conversation-derived information to long-term memory without any notice, consent flow, or retention boundary. In an agent integration skill, this is risky because developers may copy the pattern directly, leading to silent storage of personal data and accumulation of sensitive behavioral profiles.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The feedback-learning path stores raw user feedback directly into persistent memory with metadata, again without notifying the user that their input will be retained. Feedback often contains free-form text and can easily include sensitive information, so silently persisting it creates privacy, compliance, and data handling risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The demo seeds and later retrieves realistic-looking personal and account data, including email, employer, timezone, login time, subscription status, and product activity, without any privacy warning, anonymization, or minimization. In an agent-memory context, this normalizes storing potentially sensitive user data and may lead downstream users to copy the pattern into production, exposing personal data through logs, prompts, vector stores, or model context.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The manifest describes a semantic memory skill with vector search, but the code also pulls authentication secrets from process environment variables. While networked memory storage itself is consistent with the purpose, secret discovery from the runtime environment is a separate sensitive capability not stated in the manifest description.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The remember() method sends arbitrary memory content and metadata to a remote server over the network with no in-code consent, warning, data classification, or filtering. In an agent setting, this can cause prompts, user data, secrets, or internal context to be silently exfiltrated to a third-party service, which is especially risky because the skill's purpose is to store semantically useful memories.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 80% confidence

Finding

The manifest describes a semantic memory capability with vector search benefits, but the code also reaches into process environment variables to obtain email, password, and API keys. Credential harvesting from the runtime environment is not an obvious semantic-memory function and expands the skill's effective capability beyond memory operations themselves.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 80% confidence

Finding

Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.

Content

Scanner excerpt · python/memorylayer_skill.py (reported line 46)May include surrounding context.

python

)
        
        # Login
        response = requests.post(
            f'{self.api_url}/auth/login',
            json={'email': self.email, 'password': self.password}
        )

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 94% confidence

Finding

This request transmits arbitrary memory content and metadata to a remote service, which can expose sensitive user or agent context outside the local environment. Because the wrapper provides convenience functions with no warning, validation, or redaction, it increases the chance of unintentional leakage of secrets or personal data.

Content

Scanner excerpt · python/memorylayer_skill.py (reported line 75)May include surrounding context.

python

"""
        self._ensure_auth()
        
        response = requests.post(
            f'{self.api_url}/memories',
            json={
                'content': content,

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill sends user-provided memory content and search queries to a remote third-party service without any built-in user-facing disclosure, consent gate, or data-sensitivity checks. In an agent context, this is risky because memory content may include prompts, personal data, credentials, or business-sensitive context that users may assume remains local.

Content

No source excerpt is available for this finding.

External Transmission

Medium

• Category: Data Exfiltration
• Confidence: 92% confidence

Finding

The search endpoint sends natural-language queries to the remote service, and those queries may themselves contain sensitive operational context, internal prompts, or personal information. In an agent setting, even retrieval queries can reveal confidential intent or data relationships, especially when sent automatically without user awareness.

Content

Scanner excerpt · python/memorylayer_skill.py (reported line 102)May include surrounding context.

python

"""
        self._ensure_auth()
        
        response = requests.post(
            f'{self.api_url}/memories/search',
            json={'query': query, 'limit': limit},
            headers={'Authorization': f'Bearer {self.token}'}

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The README instructs users to export account credentials as environment variables but does not include basic secret-handling guidance such as avoiding hardcoding, preventing accidental logging, and using a secret manager in production. While environment variables are common, the missing warning increases the chance of credential leakage through shell history, screenshots, CI logs, or committed setup scripts.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The manifest describes a semantic memory skill focused on vector search and token savings. In this example, the code's error path instructs the user to provide account credentials via environment variables and advertises an external signup URL, which is an account/authentication capability rather than core memory behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The constructor reads email, password, and API key values from environment variables, which is sensitive credential handling. While this is common technically, the file provides no comment, docstring, or user-facing notice explaining that the skill accesses these secrets.

Content

No source excerpt is available for this finding.

Known Vulnerable Dependency: follow-redirects==1.15.11 — 1 advisory(ies): CVE-2026-40895 (follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Ta)

Low

• Category: Supply Chain
• Confidence: 84% confidence

Finding

follow-redirects 1.15.11 is flagged for leaking custom authentication headers across cross-domain redirects. Since axios depends on this package and agent skills commonly make authenticated outbound requests, a malicious or compromised redirect target could capture API keys, bearer tokens, or internal auth headers.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The dependency is specified with a caret range ("^1.6.0"), which allows newer minor and patch releases to be installed implicitly. This weakens build reproducibility and can unintentionally pull in a compromised or vulnerable upstream release, which is especially relevant here because the package already appears to resolve to a vulnerable axios version.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"url": "https://github.com/davidhx1000-cloud/memorylayer-skill"
  },
  "dependencies": {
    "axios": "^1.6.0"
  },
  "scripts": {
    "test": "node examples/basic-usage.js"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 94% confidence

Finding

The dependency is specified with only a lower bound (requests>=2.31.0), which makes builds non-reproducible and allows different environments to install different releases over time. This increases supply-chain risk and makes it impossible to guarantee that tested and deployed versions are the same, including whether later vulnerable or incompatible versions are pulled in.

Content

Scanner excerpt · python/requirements.txt (reported line 4)May include surrounding context.

text

# MemoryLayer Python Wrapper Dependencies

# HTTP client
requests>=2.31.0

# Future: When published to PyPI
# memorylayer>=1.0.0

Unverifiable Dependency: requests has 16 known advisory(ies) (CVE-2014-1830 (Exposure of Sensitive Information to an Unauthorized Actor in Requests); CVE-2024-47081 (Requests vulnerable to .netrc credentials leak via malicious URLs); CVE-2024-35195 (Requests `Session` object does not verify requests after making first request wi) +13 more), but the manifest does not pin a version, so it is unknown whether the installed release is affected

Low

• Category: Supply Chain
• Confidence: 88% confidence

Finding

Because requests is not pinned, the manifest does not establish whether installations will use a version affected by one of the known advisories or a fixed release. In practice this means consumers may unknowingly install a vulnerable version depending on resolver behavior, mirrors, cached environments, or future package changes.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.env_credential_access, suspicious.exposed_secret_literal

Environment variable access combined with network send.

Critical

• Code: suspicious.env_credential_access
• Location: index.js:5

Python code POSTs credential environment variables to an environment-controlled URL.

Critical

• Code: suspicious.env_credential_access
• Location: python/memorylayer_skill.py:46

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: index.js:7