agent-memory-mcp

CRITICAL E005: Suspicious download URL detected in skill instructions.

• Suspicious download URL detected (high risk: 0.80). Localhost is not an external download source, but the GitHub repo is an individual/unverified account and the skill explicitly instructs cloning and running npm scripts (which can execute arbitrary code), so obtaining and executing binaries from this source is potentially high risk.

MEDIUM W012: Unverifiable external dependency detected (runtime URL that controls agent).

• Potentially malicious external URL detected (high risk: 0.90). The skill's setup requires cloning and running the remote repository https://github.com/webzler/agentMemory.git, which fetches external code that is then executed (via npm run start-server), so it is a runtime dependency that can execute remote code.