agentmemory-persistent-memory
Warn
Audited by Gen Agent Trust Hub on May 16, 2026
Risk Level: MEDIUMEXTERNAL_DOWNLOADSCOMMAND_EXECUTION
Full Analysis
- [EXTERNAL_DOWNLOADS]: The skill facilitates the download and installation of the
@agentmemory/agentmemorypackage from the npm registry usingnpm installandnpx. This is an unverifiable third-party package not included in the trusted vendor list. - [COMMAND_EXECUTION]: The
agentmemory connectcommands modify sensitive configuration files in user directories, such as~/.claude-code/plugins/agentmemory.jsonand~/Library/Application Support/Cursor/. This behavior allows the skill to inject its own code or server settings into other applications. - [COMMAND_EXECUTION]: The instructions include the use of
npx -y @agentmemory/agentmemory@latest, which allows for the immediate execution of remote code without pinning a specific version or performing integrity checks.
Audit Metadata