Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- servers/remembrance-mcp.mjs:10113
- Evidence
function localAgentIdentityPath(env = process.env, homeDirectory = homedir2()) {
Security audit
Remembrance
Security checks across malware telemetry and agentic risk
Overview
This is a disclosed Remembrance memory plugin that can send redacted task summaries and feedback to its service, with no artifact evidence of hidden, destructive, or unrelated behavior.
Install only if you are comfortable granting this non-bundled plugin conversation-hook access and allowing redacted task summaries, result IDs, feedback, preferences, and outcome metadata to be sent to Remembrance or your configured registry. Use an organization key for private team memory, keep the local config and agent key private, and disable auto-query or update checks with the documented environment variables if those behaviors are not desired.
SkillSpector
By NVIDIA
SkillSpector was not run because this plugin release contains no bundled skills.
VirusTotal
50/50 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.env_credential_access