Agentmemory Agents

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 10:15 AM UTC
• Version: 0.1.0

Overview

This skill is a disclosed guide for connecting agentmemory to host coding agents, with manageable review notes around explicit target selection and unpinned external skill installation.

Before installing, run connect with an explicit supported agent name, confirm the target config path, and review or pin the separate rohitg00/agentmemory action-skill install instead of relying on a floating npx command.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:25

Finding

Unpinned Third-Party Skill Installation

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, line 25
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

Vulnerable Code

markdown

- The action skills (remember, recall, and the rest) are installed separately with `npx skills add rohitg00/agentmemory`. `connect` makes tools available; skills teach the agent when to use them.

Technical Analysis

The documented installation command identifies a mutable third-party repository without specifying an immutable commit, release version, checksum, or signature. It also relies on npx, which can retrieve and execute package tooling.

The external Skill content is not included in this project and therefore was outside the reviewed artifact. Its effective behavior can change after this version of SKILL.md has been audited. Compromise of the package, repository, publisher account, or mutable upstream branch could cause users to install unreviewed instructions or executable content with their own privileges.

Attack Path

1. An attacker compromises the referenced repository, package-distribution path, or publisher account, or introduces malicious content into the mutable upstream revision.
2. A user or agent follows the installation instruction on line 25.
3. npx retrieves and runs the applicable tooling, which obtains content from the mutable rohitg00/agentmemory source.
4. The unreviewed Skill content is installed into the host environment.
5. When the host loads or invokes the installed content, attacker-controlled instructions or code can execute within the permissions available to that host and user.

Impact Assessment

Successful exploitation could permit attacker-controlled Skill instructions or code to run with the invoking user's privileges. Depending on the retrieved payload and host permissions, the impact may include agent instruction hijacking, access to data available to the host agent, unauthorized tool use, configuration modifi ...[truncated 180 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the installer package and third-party Skill source to audited, immutable versions or commit hashes.
• Verify cryptographic checksums or trusted signatures before installation.
• Resolve and display the exact package version, source repository, and commit before executing the installation.
• Require explicit user confirmation before downloading or enabling external Skill content.
• Download the dependency without immediately enabling it, then audit its instructions and executable files.
• Use a trusted registry with lockfiles, integrity metadata, and restricted publisher permissions where possible.
• Re-audit and deliberately update the pinned revision when upstream changes are required.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

Defaulting to claude-code when agent detection is unknown can silently modify the wrong host configuration. In a tool that edits agent config files and wires in servers, ambiguous fallback behavior increases the chance of unintended config changes, broken setups, or accidental enablement in an unintended environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 92% confidence

Finding

The skill instructs users to run npx skills add rohitg00/agentmemory without pinning a version or immutable source. That can cause installation of whatever package/version is current at execution time, which creates a supply-chain risk if a future release is compromised, unpublished/replaced, or unexpectedly changes behavior.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.