rolemem@0.3.0
VERIFIED· install onlyPublisher claims: "Enables AI clients to read and write a single self-hosted memory store over MCP, so memories persist across models and sessions, with JSON import/export for portability." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Nothing executable in the bundle ran; the trace covers the install step only.- Tested
- every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
LLM_API_KEYROLEMEM_ADMIN_TOKENROLEMEM_AUTH_FAILSConfiguration, not credentials: LLM_BASE_URL, LLM_MODEL, ROLEMEM_DB, ROLEMEM_DIGEST_CHAR_CAP, ROLEMEM_DIGEST_MAX, ROLEMEM_PUBLIC_URL, ROLEMEM_RATE_PER_MIN, ROLEMEM_TRUST_PROXY- Where it talks to
- no vendor host named in the codeAlso apple.com — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it with a scoped credential, under the guard, and read the third-party hosts first. The code names apple.com as well as its own vendor. The guard injects LLM_API_KEY, ROLEMEM_ADMIN_TOKEN, ROLEMEM_AUTH_FAILS only into requests to the host you bind (and its subdomains) and refuses the rest.
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 81/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 1 scenarios · 0 deviationsStatic findings
const original = 'model = "gpt-5"\n\n[mcp_servers.other]\nurl = "http://x"\n\n[mcp_servers.rolemem]\nurl = "http://old"\n\n[profiles.fast]\nmodel = "mini"\n';Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.console.log("For a client that cannot send headers, the key is in the URL. Treat the URL as a password. It may show up in proxy logs.\n" + `${url}/${key}`);Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why."demo": "node --no-warnings --env-file-if-exists=.env scripts/demo.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.assert.ok(out.endsWith('[mcp_servers.rolemem]\nurl = "http://127.0.0.1:8787/mcp/rmk_new"\n'));Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them."service": "node --no-warnings --env-file-if-exists=.env scripts/service.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.assert.match(headed, /\[mcp_servers\.rolemem\.http_headers\]\nAuthorization = "Bearer rmk_new"/);Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.if (/127\.0\.0\.1|localhost/.test(base)) console.log("This is a local address. Cloud clients cannot reach it until you put HTTPS in front (see the README).");Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why."connect": "node --no-warnings --env-file-if-exists=.env scripts/connect.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose."dev": "node --no-warnings --env-file-if-exists=.env --watch src/server.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose."start": "node --no-warnings --env-file-if-exists=.env src/server.ts",Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.const args = [opts.node, "--no-warnings", "--env-file-if-exists=.env", "src/server.ts"];Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.const out = JSON.parse(upsertCursorJson('{"mcpServers":{"gh":{"command":"gh"}},"x":1}', "rolemem", "http://h/mcp", "rmk_k"));Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.assert.ok(out.includes('[mcp_servers.other]\nurl = "http://x"'));Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.? `${header}\nurl = ${JSON.stringify(url)}\n\n[mcp_servers.${name}.http_headers]\n${headerLines.join("\n")}\n`Fix: Namespace tool names and keep tool descriptions literal; no instructions to the agent inside them.Cost to the agent
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.