Mem0 Memory Setup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:04 AM UTC
• Version: 1.0.0

Overview

This looks like a real Mem0 setup guide, but it exposes API keys in terminal output and configures persistent cloud memory using broad, unpinned install steps.

Review this skill before installing. Only use it if you are comfortable enabling a cloud-backed memory provider for Hermes. Do not print or paste the Mem0 API key into terminal logs or chats; prefer a non-disclosing secret update flow, restrict permissions on `~/.hermes/.env`, and consider pinning package versions before running the install commands.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:29

Finding

Unpinned Third-Party Package Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:29-35, SKILL.md:50, and SKILL.md:65
Vulnerability Type: Supply-chain exposure through unpinned pip and npm dependencies
Risk Level: Medium

Vulnerable Code

bash

pip install mem0ai

bash

pip install mem0ai -i https://pypi.tuna.tsinghua.edu.cn/simple

bash

npm install -g @mem0/cli

The global npm installation command is repeated at line 65 after changing the npm prefix.

Technical Analysis

The installation commands do not pin reviewed package versions or verify package integrity. Their effective behavior can therefore change whenever a package publisher, registry, or mirror serves a new release.

Python packages may execute build backend code during installation, while npm packages may execute lifecycle scripts. Consequently, compromise of the package publisher, registry, mirror, or a future package version could result in attacker-controlled code running with the privileges of the user performing the installation.

The alternative pip command introduces an additional trust relationship with a third-party package mirror. The npm installation is global within the configured user prefix, increasing the number of workflows that may subsequently load or invoke the installed executable. The instructions appropriately discourage sudo, so no direct privilege escalation is established, but the installation still grants dependencies the full privileges of the current user.

Attack Path

1. An attacker compromises a package publisher account, package distribution channel, registry, mirror, or future package release.
2. The attacker publishes a modified mem0ai or @mem0/cli package containing malicious build or lifecycle behavior.
3. A user or Agent follows the Skill and installs the package without a version or integrity constraint.
4. The package manager retrieves the attacker-controlled release.
5. Installation code exe ...[truncated 783 chars]

Remediation

View remediation

Remediation Suggestions

• Pin both dependencies to versions that have been reviewed and tested instead of installing the latest available releases.
• For pip, use a locked requirements file with hashes and require hash verification during installation.
• Prefer an isolated Python virtual environment rather than modifying a shared interpreter environment.
• Pin the npm package to an exact reviewed version and use lockfile or integrity controls where the installation workflow permits.
• Verify the expected package publisher, registry, and package provenance before installation.
• If a mirror is offered, explain the additional trust boundary and provide a method to verify that artifacts match the authoritative distribution.
• Continue avoiding sudo; install only with ordinary user privileges.
• Disable unnecessary package lifecycle scripts where practical, or review the package contents and lifecycle scripts before allowing them to execute.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:107

Finding

Mem0 API Key Exposed Through Terminal Output and Plaintext Configuration Handling

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:107-118 and SKILL.md:213
Vulnerability Type: Plaintext credential disclosure and unsafe credential-file update
Risk Level: Medium

Vulnerable Code

bash

python3 -c "import json; print(json.load(open('/home/po/.mem0/config.json'))['platform']['api_key'])"

bash

cat ~/.mem0/config.json

bash

MEM0_KEY=$(python3 -c "import json; print(json.load(open('$HOME/.mem0/config.json'))['platform']['api_key'])")
echo "export MEM0_API_KEY=$MEM0_KEY" >> ~/.hermes/.env

The troubleshooting section also displays the matching credential line:

bash

grep MEM0_API_KEY ~/.hermes/.env

Technical Analysis

Reading the Mem0 credential and configuring Hermes are necessary for the declared integration. However, printing the API key, displaying the complete Mem0 configuration, and using grep without quiet mode exceed the minimum access and disclosure needed to complete or verify that configuration.

Terminal output may be captured by session recording, CI logs, remote-support tooling, screenshots, scrollback, or Agent transcripts. Displaying the entire config.json may also reveal additional sensitive configuration beyond the API key.

The .env update uses append redirection without first enforcing restrictive permissions or detecting an existing MEM0_API_KEY entry. Repeated execution can create duplicate or stale credential definitions. The Skill does not verify that ~/.hermes/.env is readable only by the owning user.

The first Python command also hard-codes /home/po, which may reference the wrong user's configuration on another system. The later command correctly uses $HOME.

Attack Path

1. A user or Agent follows the documented key-reading or troubleshooting instructions.
2. The API key is printed directly to the terminal, or the entire Mem0 configuration is displayed.
3. Terminal output is retained in scrollback, l ...[truncated 982 chars]

Remediation

View remediation

Remediation Suggestions

• Remove commands that print the API key or display the complete config.json.
• Transfer the key directly from its source to the destination configuration without emitting it to standard output.
• Use $HOME consistently instead of the hard-coded /home/po path.
• Create the Hermes configuration directory and credential file under a restrictive umask, and enforce owner-only permissions such as mode 0600.
• Replace an existing MEM0_API_KEY definition atomically instead of appending another entry on every run.
• Avoid placing secret values in command arguments where they may become visible through process inspection.
• Verify configuration with a non-disclosing check, for example:

  bash

  if grep -q '^export MEM0_API_KEY=' "$HOME/.hermes/.env"; then
    echo "MEM0_API_KEY is configured"
  else
    echo "MEM0_API_KEY is not configured"
  fi
  

• Prefer a supported operating-system secret store or Hermes credential-management facility if one is available.
• Document API-key rotation and revocation procedures for cases where terminal output or configuration permissions may have exposed the credential.

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

文档明确指导使用 python3 -c ... print(...['platform']['api_key']) 和 cat ~/.mem0/config.json 直接读取并回显 API Key，随后再把密钥拼接写入 shell 环境文件。这会把敏感凭据暴露在终端输出、shell 历史、日志、录屏或代理层观测面中，属于明显的凭据处理不当。

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

该步骤从 ~/.mem0/config.json 提取 API Key 并通过 shell 变量与 echo 追加到 ~/.hermes/.env，会让密钥短暂出现在命令行、进程参数展开、shell 历史以及可能的调试日志中。把长期凭据直接写入明文 .env 也增加了本地泄露、误提交到版本库和被其他本地进程读取的风险。

Content

Scanner excerpt · SKILL.md (reported line 118)May include surrounding context.

bash

MEM0_KEY=$(python3 -c "import json; print(json.load(open('$HOME/.mem0/config.json'))['platform']['api_key'])")
echo "export MEM0_API_KEY=$MEM0_KEY" >> ~/.hermes/.env

设置 provider：

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 213)May include surrounding context.

检查以下 env var 是否已设置：

bash

grep MEM0_API_KEY ~/.hermes/.env

4. npm 全局安装报 EACCES

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

该技能的触发短语包含“配置记忆”“memory provider”“让 Hermes 记住我”等较泛化表达，容易与普通咨询或高层次讨论重叠，导致在不需要时误触发该技能。一旦误触发，技能会引导执行安装、账号注册、读取本地配置和写入环境变量等高影响操作，扩大敏感配置暴露面。

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 222)May include surrounding context.

bash

npm config set prefix ~/.npm-global
# 之后安装无需 sudo

5. fish shell 下 which 找不到

Static analysis

No suspicious patterns detected.