wenshuangl/agent-mem

• Outcome: Review
• Latest audit: May 29, 2026 · 9:40 PM UTC
• Version: 1.0.3

Overview

This is a local multi-agent memory tool, but it has under-disclosed cross-agent data sharing and a hidden background process hook that users should review before installing.

Install only if you want a local system that stores, indexes, and shares agent memory across sessions and agents. Before using it with sensitive work, review or disable the engine_v2.py dbridge launcher, limit which ~/.agent-mem agent folders are indexed, configure explicit sharing rules, and keep backups because the forgetting and cache-clear paths can delete stored memory.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (32)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import subprocess
        bridge = Path(__file__).parent.parent / 'scripts/dbridge.py'
        if bridge.exists():
            subprocess.Popen([sys.executable, str(bridge)], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    except:
        pass

• Confidence: 93% confidence
• Finding: subprocess.Popen([sys.executable, str(bridge)], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

subprocess module call

Medium

• Category: Dangerous Code Execution

Content

import subprocess
        bridge = Path(__file__).parent.parent / 'scripts/dbridge.py'
        if bridge.exists():
            subprocess.Popen(['python3', str(bridge)], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)
    except:
        pass

• Confidence: 94% confidence
• Finding: subprocess.Popen(['python3', str(bridge)], stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL)

exec() call detected

High

• Category: Dangerous Code Execution

Content

}
        for attr, (cls_name, imp) in modules.items():
            try:
                exec(imp)
                klass = eval(cls_name)
                setattr(self, attr, klass(self.memory_dir))
                self.state[f'{attr}_loaded'] = True

• Confidence: 98% confidence
• Finding: exec(imp)

eval() call detected

High

• Category: Dangerous Code Execution

Content

for attr, (cls_name, imp) in modules.items():
            try:
                exec(imp)
                klass = eval(cls_name)
                setattr(self, attr, klass(self.memory_dir))
                self.state[f'{attr}_loaded'] = True
            except Exception as e:

• Confidence: 97% confidence
• Finding: klass = eval(cls_name)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill advertises installation and runnable commands that imply filesystem access, shell execution, and likely network-capable components, yet it declares no permissions. This creates a trust and review gap: users and platforms cannot accurately assess what the skill may access or do before installation or execution, increasing the chance of unexpected data access or command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose understates materially sensitive behaviors, including external HTTP requests, subprocess invocation, background process launching, and local knowledge-base indexing across directories. That mismatch is dangerous because operators may install a seemingly local memory skill while it can communicate externally, execute tools, and persist or scan data in ways not clearly disclosed.

Context-Inappropriate Capability

High

• Confidence: 95% confidence
• Finding: The skill launches an external dispatch-learning bridge that is not necessary for basic memory operations, which introduces hidden behavior and a new execution surface. Because it runs in the background and is tied to a multi-agent dispatch system, it can extend access to memory data and trigger unintended actions beyond user expectations.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: Although the function presents itself as syncing important facts, it distributes both important facts and additional non-important facts to every active agent. In a cross-agent memory system, that broadens data exposure and can leak user-derived content to agents that do not need it.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The code scans ~/.agent-mem/agents, reads markdown from each agent's private agent/ directory, and indexes that content into a unified persistent Chroma collection. This creates cross-agent data aggregation beyond a narrow memory/dispatch role and can expose private or sensitive per-agent knowledge to broader search paths, violating isolation assumptions and enabling unintended data disclosure.

Context-Inappropriate Capability

Medium

• Confidence: 97% confidence
• Finding: This routine harvests markdown files from all agent directories and stores them in one searchable collection, effectively centralizing knowledge across agents. Even though search() applies some category filtering, the unified storage model increases blast radius if querying logic is bypassed, misconfigured, or extended, and it can leak information that individual agents did not intend to share.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The document explicitly promotes cross-channel memory sharing and detailed end-to-end task logging, including who initiated a task, via which channel, and execution outcomes, but provides no warning, consent model, retention guidance, or privacy boundaries. In a multi-agent memory system, this can lead to unintended aggregation of user data across contexts and channels, increasing privacy leakage, profiling, and compliance risk.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The README explicitly promotes cross-channel memory sharing and automatic logging of who initiated tasks, where they were sent, and the results, but provides no notice about consent, data minimization, retention, or access controls. In a multi-agent memory system, this can lead to unanticipated propagation of sensitive user data across channels and persistent storage of activity metadata, increasing privacy, compliance, and insider-misuse risk.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README explicitly promotes cross-channel memory sharing and full-chain dispatch logging, but provides no warning about privacy boundaries, consent, retention, or sensitive-data handling. In a multi-agent memory system, this can lead users to unknowingly persist and propagate personal or confidential information across platforms, increasing the risk of unauthorized disclosure and over-collection.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The module persistently stores dispatch metadata, including task and detail fields, in a local JSON file under the user's home directory without any consent, disclosure, minimization, or access control. In an agent memory/dispatch system, those fields can easily contain sensitive prompts, user content, internal routing context, or secrets, creating a privacy and local data exposure risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The sync routine silently modifies the engine state file to incorporate dispatch-derived state, effectively propagating previously logged activity into another persistence layer without user awareness. In this skill context, cross-memory injection increases exposure and makes sensitive operational history available to other components that consume engine state, broadening the blast radius of any logged secrets or private user data.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: Background subprocess execution occurs without clear user-facing disclosure, preventing informed consent and undermining auditability. In a memory-handling skill, hidden execution is especially risky because users reasonably expect storage operations, not silent process creation tied to dispatch behavior.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The engine writes memory content into multiple agent HOT caches without clear disclosure or granular consent. In a multi-agent environment, undisclosed cross-channel sharing materially increases privacy and confidentiality risk because more components can access user-derived facts.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The code persists extracted entity metadata and relationship data into hidden files in the user's home-scoped memory directory without any consent flow, disclosure, retention control, or access restriction. In a multi-agent memory system, this creates covert accumulation of potentially sensitive behavioral and identity data, increasing privacy risk and making later misuse or unintended cross-context exposure more likely.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code automatically deletes memory entries from the timeline when their score falls below a threshold, and it does so immediately by mutating and rewriting the persistent JSON store without any confirmation, dry-run mode, backup, or recovery path. In a memory-management skill, this is materially risky because the data may include important user context, and scoring/date errors or malformed entries can cause irreversible loss of information.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The code persists conversation summaries to disk under the user's home directory without any notice, consent flow, encryption, or access control checks. In a multi-agent, cross-channel memory system, these cached summaries may contain sensitive cross-channel context, making local disclosure and unexpected retention materially more risky than ordinary transient session state.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The clear operation deletes an agent's cache file immediately with no confirmation, authorization layer, or recovery mechanism. While this is primarily an integrity/availability issue rather than code execution, it can still cause accidental or unauthorized loss of conversational memory, which is more significant in a dispatch system that relies on retained context.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The engine creates a persistent vector store under .chroma-knowledge and writes a state file to disk without any visible consent, disclosure, retention policy, or data minimization controls. Persisting indexed content can retain sensitive information longer than expected and makes later local compromise or unintended reuse more damaging.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The code reads agent knowledge files from the user's home directory and persists extracted chunks into a shared collection without warning or confirmation. Because the source is a private home-directory path and the destination is a common searchable index, this materially increases the chance of unintended collection and disclosure of sensitive agent data.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: User recall queries are forwarded to an external command without any notice or consent mechanism in this file. In a memory system, queries can contain sensitive personal or operational context, so undisclosed transfer across a process boundary increases privacy and data-handling risk even if the command is local.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The module persistently writes timeline data to a hidden file on disk without any user-facing notice, consent flow, retention control, or indication that potentially sensitive memory content is being stored. In the context of an agent memory/dispatch system, this increases privacy and data-governance risk because user-derived text, topics, dates, and source metadata are silently retained across sessions.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

• Code: suspicious.dynamic_code_execution
• Location: engine_v2.py:75