agentMemo

• Outcome: Review
• Latest audit: May 28, 2026 · 3:31 PM UTC
• Version: 3.2.2

Overview

agentMemo is a plausible persistent memory server, but it needs Review because its RBAC and network behavior do not fully match its security claims.

Install only in an isolated local or containerized environment, set a strong admin key outside the project directory if possible, do not expose the service until the 0.0.0.0 binding and RBAC gaps are fixed, and treat stored memories as sensitive because scoped keys may be able to see or affect more than their intended namespaces.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (19)

Tainted flow: 'req' from os.environ.get (line 35, credential/environment) → urllib.request.urlopen (network output)

Critical

• Category: Data Flow

Content

body = json.dumps(data).encode() if data else None
    req = urllib.request.Request(url, data=body, method=method)
    req.add_header("Content-Type", "application/json")
    with urllib.request.urlopen(req, timeout=30) as resp:
        if resp.status == 204:
            return None
        return json.loads(resp.read())

• Confidence: 91% confidence
• Finding: The benchmark builds outbound requests using BASE_URL from the AGENTMEMO_URL environment variable and then sends benchmark data to that destination without validation. In a typical deployment this is intended for localhost, but if the environment variable is altered the script can exfiltrate stored task content, queries, and benchmark metadata to an attacker-controlled service or unexpected internal host.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 90% confidence
• Finding: The skill documentation describes capabilities that access environment variables, write to local files, and perform network activity, but it does not declare corresponding permissions. This is a real security issue because operators and automated policy systems cannot accurately assess or sandbox the skill, increasing the chance of unintended secret access, filesystem modification, and outbound connectivity.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The SSE and WebSocket subscription endpoints authenticate callers but do not verify that the caller is authorized for the requested namespace. An attacker with any valid API key can subscribe to another tenant's namespace and receive cross-namespace events, breaking the RBAC isolation explicitly promised by the service.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The batch delete path deletes memories by ID without first loading each memory and verifying namespace access. Any authenticated user who knows or can guess another namespace's memory ID may delete it, violating tenant isolation and integrity.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The namespace listing endpoint returns all namespaces after only generic authentication, with no filtering based on the caller's allowed namespaces. This leaks tenant structure and aids enumeration, making targeted cross-namespace attacks easier.

Description-Behavior Mismatch

Medium

• Confidence: 90% confidence
• Finding: The metrics and stats endpoints expose global counts and system-wide operational data rather than tenant-scoped information. In a multi-tenant memory service, this leaks information about other users' activity, volume, and infrastructure state, weakening the claimed RBAC isolation.

Missing User Warnings

Medium

• Confidence: 85% confidence
• Finding: The demo content promotes persistent cross-session storage of user preferences, project state, and prior corrections, but it does not mention consent, retention limits, access controls, or privacy expectations. In a memory system specifically intended for shared agent use across sessions and namespaces, this omission can normalize collection of potentially sensitive behavioral and work-context data without clear user disclosure, increasing the risk of privacy violations or inappropriate reuse.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The plan explicitly stores user preferences and session-traceability metadata without mentioning notice, consent, retention controls, or user-facing privacy safeguards. In a persistent cross-session memory system for AI agents, this creates a real privacy and governance risk because sensitive behavioral data can accumulate and be retrieved across contexts without the user's awareness.

Natural-Language Policy Violations

Low

• Confidence: 88% confidence
• Finding: Assigning a named individual's namespace for chat preferences normalizes storing person-specific memory without any stated consent, policy basis, or access restrictions. While the immediate technical impact is limited in this markdown plan, it signals a design pattern that could lead to privacy violations or unauthorized profiling once implemented.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The script performs destructive deletion of memories after the benchmark using collected IDs and namespace-wide cleanup with no confirmation prompt, dry-run mode, or strong scoping guarantees. In a memory server context, this is dangerous because running against a non-test or shared instance can erase real data, and the broad search-based cleanup increases the risk of deleting unintended records if namespaces or queries overlap with legitimate content.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The client defaults to http://localhost:8790 and sends memory contents, search queries, and API keys over plaintext HTTP with no warning or TLS enforcement. In agent-memory systems, this data can include highly sensitive prompts, secrets, and cross-session context, so interception or local proxying could expose both content and credentials.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The installer persists a user-supplied admin key into a plaintext .env file in the working directory without setting restrictive permissions or warning the user. Secrets written to disk can be exposed through backups, repository commits, shared directories, shell tooling, or local multi-user access, which is especially relevant because this key enables RBAC administration.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The installer persists the provided admin key into a plaintext .env file in the working directory without setting restrictive permissions or warning the operator about credential-at-rest risks. That can expose the key through local file disclosure, backups, shell history/workspace sync, accidental commits, or multi-user systems, which is especially relevant because this key enables administrative access to a shared memory service.

Ssd 3

High

• Confidence: 96% confidence
• Finding: The answer logic returns the full text of the top retrieved memory directly to the caller. In a memory system skill, this is dangerous because any successful retrieval exposes raw stored content verbatim, which can leak secrets, personal data, prior conversation content, or sensitive project state across sessions or principals if access controls or query boundaries fail.

Ssd 3

Medium

• Confidence: 89% confidence
• Finding: The full report persists detailed results including queries and generated responses, which may contain recalled memory text from prior storage operations. This creates a secondary leak channel on disk, extending exposure beyond the live service and increasing the chance of later disclosure through filesystem access, backups, or artifact sharing.

Credential Access

High

• Category: Privilege Escalation

Content

echo "AGENTMEMO_ADMIN_KEY=$AGENTMEMO_ADMIN_KEY" >> "$ENV_FILE"
fi
echo ""
echo "✅ .env written to $ENV_FILE"

# Verify import
"$VENV_DIR/bin/python" -c "import server, database, embeddings, models, events; print('Import check: OK')"

• Confidence: 98% confidence
• Finding: This line appends AGENTMEMO_ADMIN_KEY to .env in plaintext, creating a durable local copy of an administrative secret. If the file is readable by other users, accidentally committed, or collected by logs/backups, an attacker could gain administrative control over the memory service and bypass intended RBAC protections.

Credential Access

High

• Category: Privilege Escalation

Content

echo "  source .venv/bin/activate && python server.py"
echo ""
echo "Or with dotenv:"
echo "  env \$(cat .env | xargs) .venv/bin/python server.py"
echo ""
echo "Dashboard: http://localhost:${AGENTMEMO_PORT}/dashboard"
echo "Health:    http://localhost:${AGENTMEMO_PORT}/health"

• Confidence: 93% confidence
• Finding: The recommended startup command uses `env $(cat .env | xargs)`, which is unsafe for secrets because it performs shell parsing on file contents and can mis-handle special characters, whitespace, or quoting in the admin key. This can lead to accidental secret exposure in process listings/history or broken parsing that changes runtime behavior; in a worst case, crafted .env content could inject unintended environment assignments.

Credential Access

High

• Category: Privilege Escalation

Content

echo "AGENTMEMO_ADMIN_KEY=$AGENTMEMO_ADMIN_KEY" >> "$ENV_FILE"
fi
echo ""
echo "✅ .env written to $ENV_FILE"

# Verify import
"$VENV_DIR/bin/python" -c "import server, database, embeddings, models, events; print('Import check: OK')"

• Confidence: 93% confidence
• Finding: This line appends AGENTMEMO_ADMIN_KEY directly into a plaintext .env file. In the context of agentMemo, the admin key protects RBAC and shared agent memory namespaces, so compromise of this secret could allow unauthorized administrative actions and access to sensitive stored memory across sessions or agents.

Credential Access

High

• Category: Privilege Escalation

Content

echo "  source .venv/bin/activate && python server.py"
echo ""
echo "Or with dotenv:"
echo "  env \$(cat .env | xargs) .venv/bin/python server.py"
echo ""
echo "Dashboard: http://localhost:${AGENTMEMO_PORT}/dashboard"
echo "Health:    http://localhost:${AGENTMEMO_PORT}/health"

• Confidence: 84% confidence
• Finding: The script instructs users to launch the server with env $(cat .env | xargs), which encourages loading secrets from a plaintext file and can mishandle values with spaces or special characters. It also normalizes insecure operational practice around a file that may contain the admin key, increasing the chance of accidental disclosure via process inspection, logs, or copied commands.

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: README.md:158

File appears to expose a hardcoded API secret or token.

Critical

• Code: suspicious.exposed_secret_literal
• Location: server.py:130