Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/index.js:62
- Evidence
if (process.env.VOYAGE_API_KEY) return "voyage";
Security audit
Nexus Memory
Security checks across malware telemetry and agentic risk
Overview
This memory plugin does useful disclosed memory storage, but it also silently changes agent behavior in ways that are broader than the README explains.
Install only if you want automatic conversation capture and recall through Qdrant and your embedding provider. Review the runtime behavior first: it can alter tool execution, filter outgoing assistant messages, delete/recreate the configured Qdrant collection on dimension mismatch, and contains hardcoded personal guardrail paths that may not fit your environment.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.env_credential_access