nowledge-mem-docker

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The prompt explicitly instructs the agent to read and hand the Access Anywhere API key (a long secret starting with "nmem_") and other tokens verbatim to the user (via commands like ./nmemctl up and ./nmemctl key), which requires the LLM to output secret values directly.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). This skill explicitly runs git clone https://github.com/nowledge-co/community.git and pulls docker.io/nowledgelabs/mem as part of the Path A install/upgrade flow, which fetches remote code (the nmemctl controller, compose stack, and the container image) that will be executed at runtime and is a required dependency for the skill to operate.