Ourmem

• Outcome: Review
• Latest audit: May 28, 2026 · 7:02 AM UTC
• Version: 1.1.1

Overview

This is a coherent shared-memory skill, but it asks agents to persist and share sensitive memories, upload local memory files, and store long-lived API keys with limited safeguards.

Install only if you intentionally want persistent agent memory that may be stored in ourmem cloud or your self-hosted server and shared across agents or people. Prefer self-hosting for sensitive work, review every file before import, avoid storing secrets or regulated data, confirm recipients before sharing, and keep any config containing OMEM_API_KEY or apiKey out of source control with tight local permissions.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (15)

Vague Triggers

High

• Confidence: 95% confidence
• Finding: The trigger list includes generic phrases such as 'remember this', 'save this for later', and 'don't forget', which are common in normal conversation and can cause the skill to activate unexpectedly. In a memory-sharing skill, accidental activation is dangerous because it may lead to storage, retrieval, or sharing of sensitive user content without sufficiently specific intent.

Vague Triggers

High

• Confidence: 94% confidence
• Finding: The instruction to trigger whenever the user 'wants persistent memory, memory sharing between agents, memory analytics, or memory import/export' is broad intent matching without clear boundaries. That increases the chance the skill will take over conversations that merely discuss those topics conceptually, leading to unintended memory operations or setup actions.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill directs the agent to scan the user's workspace for memory/session files and upload the 20 most recent items, but it does not require an explicit privacy warning or file-by-file consent. This can expose sensitive local data to a remote service, especially when users may not realize what files will be discovered and transmitted.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The quick reference shows conversation ingestion and profile retrieval patterns that can transmit user messages and derived personal facts to a remote memory service without any warning about privacy, consent, retention, or sensitivity review. In a persistent-memory skill, this omission is materially risky because integrators may copy these examples directly and unintentionally send personal or regulated data off-platform.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The cross-user and cross-space sharing examples normalize sending memories to other users or spaces without any warning that this can disclose private or confidential information beyond the original scope. Because this skill is specifically designed for shared persistent memory across agents and teams, missing guardrails around sharing makes accidental unauthorized disclosure substantially more likely.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The GitHub connector example includes submission of an access token and repository hookup without warning about secret handling, token scope minimization, or the fact that repository contents may be ingested into the memory platform. This is dangerous because users may paste high-privilege tokens into examples and unintentionally expose proprietary source code or secrets to an external service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The docs present rollback, batch delete, filter-based delete, and delete-all operations without a strong warning about irreversible or broad data loss. In a long-lived memory system, these examples can enable destructive mistakes at large scale, especially where filters or bulk operations are copied into automation.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The guide instructs the agent to persist an API key in ~/.claude/settings.json and even suggests shell startup files as a fallback, but does not warn that these locations store credentials in plaintext and may be readable by other local processes, backups, or users. In a memory plugin context, this is meaningful because the key grants ongoing access to remote stored memories and could enable unauthorized retrieval or modification if the host is compromised.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The OpenCode setup places the API key directly into opencode.json without warning that the credential will be persistently stored in plaintext. That creates avoidable exposure through source-control mistakes, local file disclosure, workspace sharing, and endpoint compromise, especially since the plugin is designed for persistent cross-session memory access.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The OpenClaw instructions embed the API key in openclaw.json and provide a sample config containing the secret field, but omit any caution about plaintext credential storage. Because this plugin enables shared and persistent memory, a stolen key could expose historical memory contents and allow unauthorized writes across the tenant.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The MCP setup directs users to place OMEM_API_KEY inside client config files for Cursor, VS Code, and Claude Desktop, again without warning that the key will be stored locally in plaintext. These config locations are commonly synced, backed up, or shared across devices, increasing the chance of credential leakage and unauthorized access to cloud-hosted memory data.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The guide instructs users to persist API credentials in local JSON config files under home directories without any warning about file permissions, plaintext secret storage, or safer alternatives. This increases the chance of credential exposure through backups, shared workstations, shell history, dotfile syncing, or accidental commits, especially because the credential grants access to stored memory data.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: Multiple setup examples place API keys directly into JSON configuration for OpenCode, OpenClaw, and MCP clients, again without an explicit warning that these files contain secrets. Because this skill is specifically about persistent shared memory across agents and teams, exposure of one API key could allow unauthorized reading or writing of sensitive cross-session memories.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Claude Code

`[AGENT]` Write credentials to `~/.claude/settings.json` (Claude Code's native config):

```bash
python3 -c "

• Confidence: 92% confidence
• Finding: This instruction intentionally creates long-lived credential persistence by writing OMEM_API_KEY into a native config file and suggesting shell startup persistence as a fallback. Persistent secrets increase the blast radius of local compromise and are more dangerous here because the skill enables continuous access to cross-session memory data rather than a one-time operation.

Session Persistence

Medium

• Category: Rogue Agent

Content

jq '.plugin = ((.plugin // []) + ["@ourmem/opencode"] | unique)' opencode.json > tmp.json && mv tmp.json opencode.json
```

If no `opencode.json` exists, create one:

```json
{

• Confidence: 91% confidence
• Finding: The OpenCode workflow establishes persistent credential storage in a local JSON config so the plugin can access the service across sessions. That persistence is not inherently malicious, but without safeguards or warnings it creates unnecessary long-term exposure of a secret that unlocks remote memory operations.

Static analysis

No suspicious patterns detected.