Memory (AgentMemo)

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 4:59 AM UTC
• Version: 0.1.0

Overview

This is a coherent external memory plugin, but users should understand that prompts and optional captured messages are sent to their configured AgentMemo server.

Install only if you intend to use AgentMemo as an external memory backend. Prefer a local server or a trusted HTTPS remote server, protect the API key, keep autoCapture disabled unless users consent to storing conversation snippets, and pin or otherwise verify the AgentMemo server package you run.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: config.ts:39

Finding

Sensitive conversation data and bearer tokens may be transmitted over insecure or untrusted HTTP endpoints

Content

View full analysis

Vulnerability Details

File Location: config.ts:21-21, config.ts:39-42, index.ts:56-60, index.ts:66-75, and index.ts:93-102
Vulnerability Type: Insufficient URL and transport security validation
Risk Level: Medium

Vulnerable Code

ts

const DEFAULT_SERVER_URL = "http://localhost:8790";

ts

const serverUrl =
  typeof cfg.serverUrl === "string" ? resolveEnvVars(cfg.serverUrl) : DEFAULT_SERVER_URL;

const apiKey =

ts

private buildHeaders(withBody = false): Record<string, string> {
  const headers: Record<string, string> = { Accept: "application/json" };
  if (withBody) headers["Content-Type"] = "application/json";
  if (this.apiKey) headers["Authorization"] = `Bearer ${this.apiKey}`;
  return headers;
}

ts

const res = await fetch(`${this.baseUrl}/memories/search`, {
  method: "POST",
  headers: this.buildHeaders(true),
  body: JSON.stringify(body),
});

ts

const res = await fetch(`${this.baseUrl}/memories/`, {
  method: "POST",
  headers: this.buildHeaders(true),
  body: JSON.stringify(body),
});

Technical Analysis

The configuration parser accepts serverUrl as an arbitrary string and does not parse or validate its protocol, hostname, port, embedded credentials, or destination. The HTTP client then directly appends fixed paths to that value and sends requests containing:

• Agent prompts used as semantic-search queries.
• User messages selected for automatic capture.
• The configured API key in an Authorization: Bearer header.
• The configured user or namespace identifier.

An http:// endpoint provides no transport confidentiality or integrity. If it is remote or traffic leaves a trusted loopback boundary, an on-path attacker can read conversation data and bearer credentials or manipulate responses. Because arbitrary destinations are accepted, a party capable of changing plugin configuration can al ...[truncated 1947 chars]

Remediation

View remediation

Remediation Suggestions

1. Parse the configured value with the standard URL class before constructing the client.
2. Permit only https: for non-loopback destinations.
3. Permit http: only for explicit loopback hosts such as 127.0.0.1, [::1], or a carefully validated localhost.
4. Reject unsupported schemes, embedded URL credentials, fragments, and malformed URLs.
5. Consider an administrator-controlled hostname or CIDR allowlist to prevent requests to arbitrary internal services.
6. Disable redirects or validate every redirect destination before forwarding sensitive headers.
7. Do not forward the bearer token across origins during redirects.
8. Emit a clear configuration error instead of silently accepting an insecure remote endpoint.
9. Document that remote AgentMemo deployments require TLS with certificate validation.
10. Consider separate credentials with least-privilege search and write permissions, limiting the effect of token disclosure.

T08 · Insecure Dependencies

Note

• Location: SKILL.md:52

Finding

AgentMemo installation instructions use an unpinned third-party package

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:52-55
Vulnerability Type: Unpinned third-party dependency installation
Risk Level: Low

Vulnerable Code

bash

pip install agentmemo
agentmemo server --port 8000

Technical Analysis

The documented command installs the latest version of the agentmemo package resolved by the user's configured Python package index. It does not specify a reviewed version, lock file, package hash, or verified source. Consequently, the code installed and executed by users may change after this plugin has been audited.

This is a supply-chain hardening issue rather than evidence that the current agentmemo package is malicious. The audited TypeScript package itself declares no npm runtime dependencies and contains no install script.

Attack Path

1. A user follows the server installation instructions in SKILL.md.
2. pip resolves the current package associated with the unpinned agentmemo name from the configured package index.
3. A compromised account, compromised package index, malicious future release, or unsafe alternative index supplies code different from the version originally reviewed.
4. The user starts the installed package with agentmemo server --port 8000.
5. The substituted package executes with the privileges of the user running the command.

This path depends on compromise or malicious modification of the external package or package-resolution infrastructure; no such compromise was established in the audited files.

Impact Assessment

A malicious resolved package could execute code with the installing or server-running user's privileges. Depending on those privileges, it could read accessible files and environment variables, alter user data, access network resources, or compromise memories processed by the server. The audited project does not itself elevate privileges, so the maximum scope is bounded by the account and environment used to ...[truncated 27 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin the documentation to a specific reviewed release, for example agentmemo==<reviewed-version>.
2. Provide a constraints or requirements file containing cryptographic hashes and instruct users to install with pip --require-hashes.
3. Link to the exact verified package project and source repository to reduce package-name confusion.
4. Document the expected publisher, package index, release version, and checksum.
5. Run the service under a dedicated unprivileged account or isolated container.
6. Periodically review and deliberately update the pinned version rather than implicitly consuming the latest release.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (8)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The auto-capture hook iterates over user messages and sends selected message text to an external AgentMemo HTTP service via client.add() without any consent, notice, or visible gating in this file. Because the capture heuristics include emails and preference/profile statements, sensitive personal or confidential data can be exfiltrated to a remote server, which is especially risky for a memory plugin whose purpose is persistent storage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The README states that with autoCapture: true, user messages are automatically analyzed and stored to an external AgentMemo HTTP service, but it does not prominently warn about privacy, consent, retention, or third-party data-handling implications. This is dangerous because users or operators may enable the feature without understanding that potentially sensitive conversation content will be transmitted off-process or off-host, especially when using a remote server configuration.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence

Finding

The skill documentation describes capabilities that interact with an external HTTP server and potentially use authentication, yet it does not declare any explicit tool scope or permissions. This can mislead users and reviewers about the skill’s effective access to networked resources and secrets, increasing the chance of unintended data flow or unsafe deployment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill supports automatic capture of conversation content to a self-hosted external memory server, but the documentation does not warn users that potentially sensitive prompts, secrets, or personal data may be transmitted and stored outside the default local file-based memory. Because memory plugins process conversational context, this omission materially increases the risk of unintentional privacy leakage.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This is a code file, so missing-warning checks apply. The UI help text says conversations may be automatically captured and stored to an external AgentMemo service and later injected back into context, but it does not clearly warn users about the privacy implications of transmitting/storing conversation data on an external service.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The auto-recall path sends the active user prompt to the external memory server using client.search(event.prompt, 3) before the agent starts, again without any user-facing warning in this code path. Even though the intent is memory retrieval, prompts often contain confidential business data, credentials, or personal details, so transmitting them to a remote service expands the trust boundary and creates privacy and data-handling risk.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The plugin advertises automatic capture of conversation content to a self-hosted external memory service, but the user-facing help text does not clearly warn that potentially sensitive chat data may be transmitted and stored outside the default local file-based memory. In a memory plugin, this omission creates a real privacy and data-governance risk because users may enable the feature without understanding the storage boundary change.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

Auto-recall injects stored memories into agent context automatically, but the UI text does not warn users that recalled content may contain sensitive, stale, or manipulated data that can influence model behavior. In the context of an external memory backend, this can affect privacy and context integrity, especially if the memory store is shared, poisoned, or mis-scoped.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.