Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- context-engine.js:29
- Evidence
const raw = process.env[name];
Security audit
Lethe
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed persistent-memory plugin whose data storage and retrieval behavior matches its stated purpose.
Install only if you want an agent memory layer that persists project decisions, tasks, flags, summaries, and selected context across sessions. Keep the endpoint local unless you intentionally configure remote storage, avoid logging secrets or sensitive personal data, and periodically review/delete stored memories if the Lethe server contains private work context.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
62/62 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/context-engine.js:29
- Evidence
const raw = process.env[name];