Agentmemory Hooks

• Outcome: Review
• Latest audit: Sep 16, 2026 · 10:17 AM UTC
• Version: 0.1.0

Overview

This skill is coherent for automatic agent memory capture, but it installs mutable third-party hooks that record prompts and tool activity by default with limited privacy and control details.

Review this before installing in any workspace containing secrets, proprietary code, customer data, or private prompts. Confirm exactly what the plugin stores, where the localhost service persists data, how to delete records, how to disable hooks, and whether you can install a pinned reviewed version.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:11

Finding

Unpinned Third-Party Plugin Installation from a Mutable Remote Source

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 11-16
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Medium

markdown

Install the plugin and the hooks register themselves:

```bash
/plugin marketplace add rohitg00/agentmemory
/plugin install agentmemory

text

### Technical Analysis

The installation instructions add and install a third-party plugin directly by repository and package name without specifying a reviewed commit, immutable release identifier, checksum, or signature. Consequently, the code installed when these commands are run may differ from the code that was originally audited.

This is particularly security-sensitive because the documented plugin registers lifecycle hooks and captures prompts, tool usage, and session boundaries. A compromised upstream repository, marketplace account, release process, or dependency could therefore introduce code that runs within the agent environment and receives sensitive session information.

The audit did not establish that the referenced plugin is currently malicious. The vulnerability is the absence of dependency pinning and integrity verification, which leaves installation behavior dependent on mutable upstream content.

### Attack Path

1. An attacker compromises the referenced repository, marketplace account, plugin distribution process, or one of its transitive dependencies.
2. The attacker publishes a modified version under the existing plugin identity.
3. A user follows the documented commands, which resolve and install the current mutable version without checking an approved commit or artifact digest.
4. The modified plugin registers lifecycle hooks in the agent environment.
5. Malicious hook code can inspect captured prompts and tool activity or perform other actions available to the plugin under the host user's permissions.

### Impact Assessment

Exploitation could expose prompts, tool-use records, se
...[truncated 430 chars]

Remediation

View remediation

Remediation Suggestions

• Pin the plugin to a specific reviewed commit hash or immutable, versioned release rather than installing the latest mutable version.
• Publish and verify a cryptographic checksum or signed provenance statement for the approved plugin artifact.
• Require review of the plugin's hook definitions, executable code, and transitive dependencies before installation or upgrades.
• Use an allowlisted internal mirror or trusted registry with release immutability and access controls.
• Document the permissions and data accessible to lifecycle hooks, and run the plugin with the minimum required filesystem, network, and process privileges.
• Make upgrades explicit rather than automatic, with integrity verification and security review for every new version.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill explicitly states that prompts, tool use, and session activity are captured automatically, but it does not give a clear privacy warning about what data may be collected, where it is stored, retention expectations, or the sensitivity of captured content. In an agent environment, prompts and tool traces can contain secrets, proprietary code, internal URLs, or personal data, so silent-by-default capture materially increases privacy and data leakage risk.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.