agent-memory-mcp

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.70). The localhost URL is benign (local dashboard), but the GitHub repository is an untrusted third‑party code source—cloning and running its npm scripts can execute arbitrary code and could be used to distribute malware.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's setup requires running "git clone https://github.com/webzler/agentMemory.git" and then executing the fetched code (npm install / npm run start-server), so the remote repo https://github.com/webzler/agentMemory.git is fetched at runtime and its code is executed.