agent-memory-mcp

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). Cloning and running code from an unaudited GitHub repository (webzler/agentMemory) and executing its npm scripts can run arbitrary code on your machine—while http://localhost:3333 is just the local service endpoint, the primary download vector (the GitHub repo) is untrusted and should be treated as potentially risky unless you review its source, activity, and maintainers.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 1.00). The skill's setup explicitly clones and runs code from https://github.com/webzler/agentMemory.git (git clone ...; npm install; npm run start-server), so it fetches and executes remote repository code at runtime that the agent depends on and which can directly affect agent behavior.