survivemem@0.1.0
VERIFIED· not startedPublisher claims: "Enables Claude Code and Claude Desktop to keep local persistent memory by searching and storing durable memories, checkpointing session state across compaction, and running loop-guarded debug investigations." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Coverage
Not started: dependency install failed; the server itself was not observed.- Tested
- the dependency install step · every file read, file written and host contacted by what ran
- Not tested
- server startup · the tool list · tool behavior
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
SURVIVEMEM_DAEMON_TOKEN_FILEConfiguration, not credentials: PAGER, SURVIVEMEM_ALLOW_REMOTE, SURVIVEMEM_CONFIG, SURVIVEMEM_DAEMON, SURVIVEMEM_DAEMON_URL, SURVIVEMEM_DB, SURVIVEMEM_IN_CONTAINER, SURVIVEMEM_OLLAMA_URL- Where it talks to
- no vendor host named in the code
- What the honeypot saw
- no credential files read · no network
- What we could not test
- server startup · the tool list · tool behavior
Connect it with a scoped credential, under the guard. It asks for SURVIVEMEM_DAEMON_TOKEN_FILE and talks to its vendor. Give the credential to the guard, not the server: the value never enters the server's environment and only travels to the host you bind. What the tools do with a real credential was not observed.
$vet-skills run --net declared -- <the server's command>
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; not started: dependency install failed; the server itself was not observed) on 2026-11-11 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 0 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessno install scripts in bundle
0.1sprocessdependency install exit 1 ·
0.1sclaimednot started: dependency install failed (exit 1); the server itself was not observed
0.1sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run
Static findings
MEDIUM
Python subprocess execution detectedtests/helpers.py:30 · Python subprocess execution detected
AST05subprocess.run(["git", "clone", "-q", str(src), str(dst)], check=True, capture_output=True)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/survivemem/identity.py:46 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_container.py:94 · Python subprocess execution detected
AST05return subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionsrc/survivemem/hooks.py:581 · File type combined with upload action — agent may exfiltrate local data files
AST07written = store.bump_state(s.db, sid, s.res.project_id, "_posttool_candidates")Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Privileged sudo commandtests/test_cli_inv.py:37 · Privileged sudo command — agent may execute with elevated privileges
AST05"cd /tmp && sudo dmesg | tail",Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Python subprocess execution detectedtests/test_container.py:35 · Python subprocess execution detected
AST05return subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_daemon.py:89 · Python subprocess execution detected
AST05proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_container.py:106 · Python subprocess execution detected
AST05subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/survivemem/output.py:151 · Python subprocess execution detected
AST05subprocess.run(pager, input=text, text=True, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_daemon.py:65 · Python subprocess execution detected
AST05proc = subprocess.Popen(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/helpers.py:9 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_db.py:170 · Python subprocess execution detected
AST05subprocess.Popen([sys.executable, "-c", code], stderr=subprocess.PIPE) for _ in range(6)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedsrc/survivemem/identity.py:144 · Python subprocess execution detected
AST05result = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
URL to a private-network addresstests/test_embed.py:57 · URL to a private-network address — a LAN or development target
AST07embed.embed(["x"], Config(ollama_url="http://10.0.0.2:11434"), transport=transport) is NoneFix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.LOW
URL to a private-network addresstests/test_identity.py:47 · URL to a private-network address — a LAN or development target
AST07"https://192.168.1.10/grp/repo.git",Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Privileged sudo commandtests/test_ingest.py:104 · Privileged sudo command — agent may execute with elevated privileges
AST05("sudo dmesg -w", "dmesg"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Privileged sudo commandtests/test_mcp_server.py:176 · Privileged sudo command — agent may execute with elevated privileges
AST05{"kind": "experiment", "text": "reload", "command": "sudo dmesg | tail", "result": "bad"},Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Privileged sudo commandtests/test_investigate.py:18 · Privileged sudo command — agent may execute with elevated privileges
AST05("sudo dmesg | tail -50", "dmesg"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.LOW
URL to a private-network addresstests/test_identity.py:32 · URL to a private-network address — a LAN or development target
AST07("https://192.168.1.10:8443/grp/repo.git", "192.168.1.10:8443/grp/repo"),Fix: Replace encoded or assembled strings with plain literals and remove undeclared network calls.MEDIUM
Privileged sudo commandtests/test_investigate.py:249 · Privileged sudo command — agent may execute with elevated privileges
AST05("sudo dd if=x.wic of=/dev/sdb", True),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Privileged sudo commandtests/test_hooks_inv.py:73 · Privileged sudo command — agent may execute with elevated privileges
AST05run_hook("posttool", bash(repo, "sudo dmesg | tail -20", failed=True))Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Privileged sudo commandtests/test_investigate.py:87 · Privileged sudo command — agent may execute with elevated privileges
AST05first = experiment(db, res, inv.id, "sudo dmesg | tail")Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
URL with embedded credentialstests/test_identity.py:25 · URL with embedded credentials — may be phishing or credential leaking
AST07("http://user:[email protected]:80/a/b.git", "example.org/a/b"),Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.MEDIUM
Python subprocess execution detectedtests/test_hooks.py:191 · Python subprocess execution detected
AST05proc = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Python subprocess execution detectedtests/test_identity.py:292 · Python subprocess execution detected
AST05subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
Privileged sudo commandtests/test_investigate.py:27 · Privileged sudo command — agent may execute with elevated privileges
AST05("cd a && cd b && sudo -E make -C x", "make -C x"),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Privileged sudo commandtests/test_investigate.py:243 · Privileged sudo command — agent may execute with elevated privileges
AST05("cd build && sudo -E /usr/bin/make modules", True),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Instructions loaded
≈35 tok
1 file · 81 in bundle
Tool list per prompt
≈0 tok
0 tools · 0 per tool
Handshake
no reply
launch to tools/list, stdio
Undocumented tools
0
description under 20 chars · avg 0
Tokens estimated at four characters each. The tool list is re-read by the agent on every turn, so it is the number to compare between servers that do the same job: ranked across the index.
Known vulnerabilities
Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.