Security audit

Memory (AgentMemo)

Security checks for vulnerabilities and agentic risk

Overview

This is a coherent external memory plugin, but it can send prompts and opted-in captured messages to the configured AgentMemo server.

Install only if you trust and control the AgentMemo server you configure. Prefer localhost or a protected HTTPS instance, keep autoCapture off unless you intentionally want conversation-derived memories stored, and avoid using it for secrets, regulated data, or private conversations unless you have retention and deletion controls.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README explicitly states that with `autoCapture: true`, user messages are analyzed and stored on an external AgentMemo HTTP service, but it does not provide a clear privacy warning, consent requirement, or data-sharing notice. This is dangerous because operators may enable the feature without realizing potentially sensitive conversation content will be transmitted and persisted outside the local runtime, increasing privacy, compliance, and accidental data exposure risk.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The skill explicitly supports external memory storage plus optional auto-capture and auto-recall, but it does not clearly warn that conversation-derived content may be sent to a self-hosted HTTP service. This creates a real privacy and data-handling risk because users may enable the plugin without understanding that sensitive prompts, responses, or personal data could be transmitted, persisted, and later re-injected into context.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill explicitly offers auto-capture of conversation content to an external AgentMemo HTTP service, but this config schema only exposes a generic help string and does not provide an explicit privacy/data-transmission warning or require affirmative opt-in beyond a boolean toggle. In a memory plugin, captured conversations can contain sensitive prompts, credentials, personal data, or proprietary information, so silent or poorly-signposted export to an external service creates a real privacy and data-handling risk.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The schema enables auto-recall by default (`autoRecall: cfg.autoRecall !== false`), causing externally stored memories to be injected into agent context unless the user explicitly disables it. That creates a trust-boundary issue: remote or previously stored content can influence model behavior and expose sensitive historical data without a strong user warning or explicit consent, which is especially risky in a plugin designed to connect to a self-hosted HTTP memory service.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The plugin automatically extracts user message text and transmits selected snippets to an external AgentMemo server via HTTP without any per-transmission notice, consent prompt, or strong indication that sensitive content may leave the local agent runtime. Because the capture heuristics include personal-preference and email-like patterns, this can silently export PII or confidential user data to a remote service, especially when the server is self-hosted but not necessarily under the end user's control.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The plugin explicitly offers automatic capture of conversation content and automatic recall/injection of stored memories, but the user-facing help text does not clearly warn that potentially sensitive prompts, personal data, or secrets may be transmitted to and persisted on a self-hosted external service. In a memory backend plugin, this omission is materially relevant because users may enable these features without understanding the privacy, retention, and cross-session data exposure risks.

Static analysis

No suspicious patterns detected.