ℹ
Purpose & Capability
The SKILL.md and install metadata describe installing the getmem-ai package and calling mem.get()/mem.ingest(), which is coherent with a persistent-memory skill. However, the registry metadata claims no required env vars or install spec while the SKILL.md explicitly requires GETMEM_API_KEY and includes a pip install entry — a clear metadata/instruction mismatch.
!
Instruction Scope
Runtime instructions tell the agent to send user and assistant messages to getmem.ai (mem.ingest) and to fetch contextual memory (mem.get). This is expected for a memory service, but it means full conversation content is transmitted to an external service and stored indefinitely (no TTL/purge). The instructions also reference os.environ['GETMEM_API_KEY'] even though the registry metadata doesn't declare it. Transmitting potentially sensitive data off-host with long retention is a material privacy/security risk.
ℹ
Install Mechanism
The SKILL.md includes a pip install (getmem-ai on PyPI), which is a common and expected distribution method (moderate risk). The registry metadata earlier reported no install spec — another inconsistency between registry and SKILL.md. No downloads from arbitrary URLs are used, which reduces installation risk.
!
Credentials
The skill requires an API key (GETMEM_API_KEY) according to SKILL.md, but the registry metadata lists no required env vars or primary credential. The missing declaration of a secret-level environment variable is an incoherence and increases the chance a user won't realize they're providing a long-lived secret that allows an external service to store conversation data.
✓
Persistence & Privilege
The skill does not request always:true and does not claim elevated system privileges. Autonomous invocation is allowed by default (normal). Note: combining autonomous invocation with remote indefinite storage increases blast radius for data exfiltration, but that is a behavioral/privacy concern rather than an OS-privilege escalation.
What to consider before installing
This skill appears to be a legitimate getmem.ai integration, but there are important mismatches and privacy implications you should consider before installing:
- The SKILL.md requires a GETMEM_API_KEY and includes a pip install for getmem-ai, but the registry metadata does not declare that secret or the install step. Ask the publisher to correct the metadata so the required secret is explicit.
- Using the skill will send user and assistant messages to getmem.ai and the documentation says memory persists indefinitely. Do not enable this skill for agents that will handle sensitive, regulated, or confidential data unless you confirm retention, encryption, access controls, and deletion policies with getmem.ai.
- Verify the PyPI package (getmem-ai) is the official SDK (check maintainer, code repository, and recent releases) before installing. Prefer installing in an isolated/sandboxed environment first.
- If you need memory but cannot risk sending data externally, consider a local or self-hosted memory solution instead.
If you want to proceed, request that the publisher update the registry metadata to declare GETMEM_API_KEY as a required secret and to provide a homepage/source repository and clear privacy/retention documentation.
