Is memtrace@1.2.17 safe to install?

memtrace@1.2.17

CAUTION· install only

Publisher claims: "Code intelligence graph — MCP server + AI agent skills + visualization UI" Observed in sandbox: reads credential files.

Registry npm (MCP server)Publisher syncable-dev · publishing for 216 daysInstalls 5,658Last detonated 7d ago

What would fix this Watch Dispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.

Tested: install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested: use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-07 and scored it 58/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Access to sensitive file paths; Privileged sudo command. Summary: reads credential files.

Behavior trace

Honeypot run · 8 s · 2 scenarios

t+CategoryObserved action

1.8sfilesystemread ~/.memtrace/gpu/ort-1.26.0-cuda12-v1/linux-x64/installed.json outside project

1.8snetworkCONNECT https://registry.npmjs.org

1.8sprocessexec /app/apps/web/node_modules/.bin/npm

1.8sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/npm

1.8sprocessexec /app/node_modules/.bin/npm

1.8sprocessexec /pnpm/npm

1.8sprocessexec /usr/local/sbin/npm

1.8sprocessexec /usr/local/bin/npm

1.8sprocessexec /app/apps/web/node_modules/.bin/nvidia-smi

1.8sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/nvidia-smi

1.8sprocessexec /app/node_modules/.bin/nvidia-smi

1.8sprocessexec /pnpm/nvidia-smi

1.8sprocessexec /usr/local/sbin/nvidia-smi

1.8sprocessexec /usr/local/bin/nvidia-smi

1.8sprocessexec /usr/sbin/nvidia-smi

1.8sprocessexec /usr/bin/nvidia-smi

1.8sprocessexec /sbin/nvidia-smi

1.8sprocessexec /bin/nvidia-smi

1.8sprocessexec /usr/lib/wsl/lib/nvidia-smi

1.8sprocessexited 2: memtrace: re-run with --yes (or set MEMTRACE_INSTALL_YES=1) to approve these changes.

3.4sfilesystemread ~/.memtrace/gpu/ort-1.26.0-cuda12-v1/linux-x64/installed.json outside project

3.4snetworkCONNECT https://registry.npmjs.org

3.4sprocessexec /app/apps/web/node_modules/.bin/npm

3.4sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/npm

3.4sprocessexec /app/node_modules/.bin/npm

3.4sprocessexec /pnpm/npm

3.4sprocessexec /usr/local/sbin/npm

3.4sprocessexec /usr/local/bin/npm

3.4sprocessexec /app/apps/web/node_modules/.bin/nvidia-smi

3.4sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/nvidia-smi

3.4sprocessexec /app/node_modules/.bin/nvidia-smi

3.4sprocessexec /pnpm/nvidia-smi

3.4sprocessexec /usr/local/sbin/nvidia-smi

3.4sprocessexec /usr/local/bin/nvidia-smi

3.4sprocessexec /usr/sbin/nvidia-smi

3.4sprocessexec /usr/bin/nvidia-smi

3.4sprocessexec /sbin/nvidia-smi

3.4sprocessexec /bin/nvidia-smi

3.4sprocessexec /usr/lib/wsl/lib/nvidia-smi

3.4sprocessexited 2: memtrace: re-run with --yes (or set MEMTRACE_INSTALL_YES=1) to approve these changes.

3.4sprocessscript backend runs setup only

4.6sprocesssecond launch, clock +45 days, CI unset

6.2sfilesystemread ~/.npmrc

6.2sfilesystemread ~/.npm/_logs · ~/.npm/_cacache/index-v5/d6/4d/95351bd7b1c4630fa6590049d83b56ced950f5f2fd281f27e28527249cee · ~/.npm/_cacache/index-v5/e6/e7/836747f2490d9ad67b369ec82fb4e0b82fbb8fe3ab58c500f4dee8c5d7a6 · ~/.npm/_cacache/index-v5/98/88/b0a4db889f950b3d7f0b5a2d8e0856bb36f0a7cee15b58c8667e14b8e6fd · ~/.npm/_cacache/index-v5/d5/64/60802bcf4dcc1cd4a8991e4b1120249acb6e4c6dff8990bdba32ec4fa80d · ~/.npm/_cacache/index-v5/83/bc/0916701c6cf6b4d878768ecb507a158853b2c623b96b7a159c03472d25cf outside project

6.2sfilesystemwrote ~/.npm/_update-notifier-last-checked

6.2snetworkCONNECT https://registry.npmjs.org

6.2sprocessexec /usr/bin/faketime

6.2sprocessexec /app/apps/web/node_modules/.bin/npm

6.2sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/npm

6.2sprocessexec /app/node_modules/.bin/npm

6.2sprocessexec /pnpm/npm

6.2sprocessexec /usr/local/sbin/npm

6.2sprocessexec /usr/local/bin/npm

6.2sprocessexec /app/apps/web/node_modules/.bin/nvidia-smi

6.2sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/nvidia-smi

6.2sprocessexec /app/node_modules/.bin/nvidia-smi

6.2sprocessexec /pnpm/nvidia-smi

6.2sprocessexec /usr/local/sbin/nvidia-smi

6.2sprocessexec /usr/local/bin/nvidia-smi

6.2sprocessexec /usr/sbin/nvidia-smi

6.2sprocessexec /usr/bin/nvidia-smi

6.2sprocessexec /sbin/nvidia-smi

6.2sprocessexec /bin/nvidia-smi

6.2sprocessexec /usr/lib/wsl/lib/nvidia-smi

6.2sprocessexited 2: memtrace: re-run with --yes (or set MEMTRACE_INSTALL_YES=1) to approve these changes.

7.9sfilesystemread ~/.npmrc

7.9sfilesystemread ~/.npm/_logs · ~/.npm/_cacache/index-v5/d6/4d/95351bd7b1c4630fa6590049d83b56ced950f5f2fd281f27e28527249cee · ~/.npm/_cacache/index-v5/e6/e7/836747f2490d9ad67b369ec82fb4e0b82fbb8fe3ab58c500f4dee8c5d7a6 · ~/.npm/_cacache/index-v5/98/88/b0a4db889f950b3d7f0b5a2d8e0856bb36f0a7cee15b58c8667e14b8e6fd · ~/.npm/_cacache/index-v5/d5/64/60802bcf4dcc1cd4a8991e4b1120249acb6e4c6dff8990bdba32ec4fa80d · ~/.npm/_cacache/index-v5/83/bc/0916701c6cf6b4d878768ecb507a158853b2c623b96b7a159c03472d25cf outside project

7.9sfilesystemwrote ~/.npm/_update-notifier-last-checked

7.9snetworkCONNECT https://registry.npmjs.org

7.9sprocessexec /usr/bin/faketime

7.9sprocessexec /app/apps/web/node_modules/.bin/npm

7.9sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/npm

7.9sprocessexec /app/node_modules/.bin/npm

7.9sprocessexec /pnpm/npm

7.9sprocessexec /usr/local/sbin/npm

7.9sprocessexec /usr/local/bin/npm

7.9sprocessexec /app/apps/web/node_modules/.bin/nvidia-smi

7.9sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/nvidia-smi

7.9sprocessexec /app/node_modules/.bin/nvidia-smi

7.9sprocessexec /pnpm/nvidia-smi

7.9sprocessexec /usr/local/sbin/nvidia-smi

7.9sprocessexec /usr/local/bin/nvidia-smi

7.9sprocessexec /usr/sbin/nvidia-smi

7.9sprocessexec /usr/bin/nvidia-smi

7.9sprocessexec /sbin/nvidia-smi

7.9sprocessexec /bin/nvidia-smi

7.9sprocessexec /usr/lib/wsl/lib/nvidia-smi

7.9sprocessexited 2: memtrace: re-run with --yes (or set MEMTRACE_INSTALL_YES=1) to approve these changes.

Static findings

HIGH

Access to sensitive file pathsinstaller/dist/transformers/codex.js:104 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files|| name === `mcp_servers."${MCP_SERVER_NAME}".env`;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsinstaller/dist/rail-hook.js:199 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, MEMTRACE_RAIL_SEARCH_URL: `http://127.0.0.1:${runtime.port}` },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Privileged sudo commandbin/memtrace.js:342 · Privileged sudo command — agent may execute with elevated privilegesconsole.error("memtrace install: retry with `sudo memtrace install`.");Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Privileged sudo commandlib/upgrade-elevation.js:66 · Privileged sudo command — agent may execute with elevated privilegesreturn needsElevation(options) ? "sudo memtrace install" : "memtrace install";Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Access to sensitive file pathshooks/userprompt-claude.sh:271 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

"additionalContext": "Memtrace is active for this repository. For this code-discovery question, prefer the Memtrace MCP tools FIRST - `mcp__memtrace__find_code` for natural-language search, `mcp__memt

Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Privileged sudo commandlib/auto-setup.js:83 · Privileged sudo command — agent may execute with elevated privileges* `sudo memtrace …` keeps the invoking user's HOME on macOS (and whereverFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

npx invocation of non-well-known packagebin/memtrace.js:41 · npx invocation of non-well-known package — may execute untrusted code// ─── Signal-forwarding supervisor (the "npx memtrace start isn't working" fix) ──Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsinstall.js:250 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst next = { ...env };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Privileged sudo commandbin/memtrace.js:465 · Privileged sudo command — agent may execute with elevated privileges// Upgrade elevation (whether `memtrace install` needs sudo on THIS install)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Privileged sudo commandlib/update-banner.js:567 · Privileged sudo command — agent may execute with elevated privileges`${indent}Retry with: ${style("sudo memtrace install", caps, ANSI.bold)}\n\n`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

HIGH

Access to sensitive file pathslib/auto-setup.js:606 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, MEMTRACE_AUTO_SETUP_HOME: home, MEMTRACE_AUTO_SETUP_CWD: cwd },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsinstaller/dist/transformers/codex.js:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (tableName === `mcp_servers."${MCP_SERVER_NAME}".env`)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathslib/accelerator-runtime.js:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst result = { ...env };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

MEDIUM

npx invocation of non-well-known packagebin/memtrace.js:45 · npx invocation of non-well-known package — may execute untrusted code// from npx / a supervisor / a terminal close killed the Node shim butFix: Pin versions and sources; vendor anything fetched at install time.

AST06

HIGH

Access to sensitive file pathsinstaller/dist/transformers/codex.js:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (tableName === `mcp_servers.${MCP_SERVER_NAME}.env`)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Access to sensitive file pathsinstaller/dist/transformers/codex.js:103 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst isEnv = name === `mcp_servers.${MCP_SERVER_NAME}.env`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.

AST05

HIGH

Privileged sudo commandlib/update-banner.js:280 · Privileged sudo command — agent may execute with elevated privileges` ${elevation.parentDir} is not writable by this user, so npm needs sudo to replace the package.`,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

npx invocation of non-well-known packagelib/auto-setup.js:161 · npx invocation of non-well-known package — may execute untrusted code// launcher (a downgrade, a second install, an npx cache) mustFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Process kill commandlib/child-supervisor.js:88 · Process kill command — agent can terminate processesif (child && typeof child.kill === "function" && child.pid != null) {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

npx invocation of non-well-known packagebin/memtrace.js:704 · npx invocation of non-well-known package — may execute untrusted code// `npx memtrace@latest start`, a supervisor SIGTERM or terminal closeFix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Process kill commandinstaller/dist/rail-runtime.js:59 · Process kill command — agent can terminate processes/** Grep enrichment's hook kill (design section 10): the hook never waits longer. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Process kill commandlib/child-supervisor.js:69 · Process kill command — agent can terminate processes* are installed but never kill the child.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

File type combined with upload actioninstall.js:707 · File type combined with upload action — agent may exfiltrate local data files// setup made before ~/.memtrace/rail.json existed (< 1.2.0), put the RailFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Process kill commandinstaller/dist/rail-runtime.d.ts:25 · Process kill command — agent can terminate processes/** Grep enrichment's hook kill (design section 10): the hook never waits longer. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

npx invocation of non-well-known packagelib/auto-setup.js:165 · npx invocation of non-well-known package — may execute untrusted code// its hint (e.g. from an editor's `npx memtrace@latest mcp`) —Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

Process kill commandlib/child-supervisor.js:28 · Process kill command — agent can terminate processes// doesn't leak listeners / kill a reaped PID).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

Process kill commanduninstall.js:614 · Process kill command — agent can terminate processes// `run` is injectable so tests can check the kill commands without runningFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

npx invocation of non-well-known packagelib/child-supervisor.js:19 · npx invocation of non-well-known package — may execute untrusted code// npx / Warp / supervisors.Fix: Pin versions and sources; vendor anything fetched at install time.

AST06

MEDIUM

File type combined with upload actionlib/setup-state.js:27 · File type combined with upload action — agent may exfiltrate local data files// ~/.memtrace/setup-refresh.log output of the most recent launcher-run setupFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.

AST07

MEDIUM

Process kill commanduninstall.js:652 · Process kill command — agent can terminate processes// /T = also kill child processes (file watchers, embed-worker childrenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.

AST05

MEDIUM

npx invocation of non-well-known packagelib/child-supervisor.js:18 · npx invocation of non-well-known package — may execute untrusted code// cause of the "`npx memtrace@latest start` isn't working" reports underFix: Pin versions and sources; vendor anything fetched at install time.

AST06

LOW

Unpinned dependencybin/memtrace.js:289 · Unpinned dependency// `npm install memtrace@latest` over it would downgrade. Past latest it cameFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.

AST06

LOW

Instructs the agent to modify its persistent memory or instruction fileslib/claude-integration.js:76 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction fileCustomized content is preserved. Add personal Claude Code rules in CLAUDE.md.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

LOW

Instructs the agent to modify its persistent memory or instruction filesbin/memtrace.js:136 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file" install write the Memtrace routing directive into the project's CLAUDE.md\n" +Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

LOW

Instructs the agent to modify its persistent memory or instruction filesinstall.js:522 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file// - add a breadcrumb block to ~/.claude/CLAUDE.md if it existsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

LOW

Instructs the agent to modify its persistent memory or instruction fileslib/project-directive.js:80 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file* Add or refresh the Memtrace directive in a project CLAUDE.md.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

LOW

Instructs the agent to modify its persistent memory or instruction fileslib/claude-integration.js:45 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction fileFor your own Claude Code directives, edit CLAUDE.md instead. -->Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

LOW

Unpinned dependencylib/install-consent.js:184 · Unpinned dependency* (`memtrace install`, `npm i -g memtrace@latest`) stay friction-freeFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.

AST06

LOW

Instructs the agent to modify its persistent memory or instruction fileslib/project-directive.js:162 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file · informational: not an instruction file · informational: not an instruction file* Write the directive into `<dir>/CLAUDE.md`, creating the file if needed.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.

AST01

LOW

Unpinned dependencyuninstall.js:510 · Unpinned dependency// it during `npm install -g memtrace@latest`. That is an upgrade, not a userFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.

AST06

Cost to the agent

Instructions loaded

≈43 tok

1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for memtrace@1.2.17 as of 7d ago. This is the package itself, not its dependencies.

What would make this Verified

22 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%

Reads credential files≈ +27 on the totalThe sandbox saw reads under ~/.ssh, ~/.aws, ~/.npmrc, ~/.config or similar. Read only files inside the project, and only the ones the task needs. Seen: ~/.npmrc.
Unclaimed publisher≈ +8 on the totalClaim syncable-dev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
Unpinned dependencies≈ +4 on the totalPin exact versions (and ideally hashes) in package.json, requirements or the install script so the bundle cannot change under you.
Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.

Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim syncable-dev Propose a patch to the maintainer

Watch this skill

One email when memtrace gets a new release, its verdict moves, or the maintainer changes. Free, no account needed.

Safer alternatives

Verified skills that do a similar job.

plugin-knowledge95 · Verified
runpod · npm · 20,606 installs · graph, skills
google-agents-cli-adk-code91 · Verified
google · skills.sh · 572,900 installs · code, graph
google-agents-cli-scaffold91 · Verified
google · skills.sh · 570,320 installs · code, skills

README badge

Shows the live score and label; updates itself as new versions are detonated. Paste into your README or registry listing:

[![KillerSkills verdict for memtrace](https://killerskills.ai/badge/npm/memtrace.svg)](https://killerskills.ai/skills/npm/memtrace?ref=badge)

Version history

1.2.2063 · Caution

1.2.1963 · Caution

1.2.1758 · Caution

Stable for 2 days. Same maintainers since first release.

Declared permissions

networknone

filesystem./ (project)

memorynone

1 of 3 declarations violated in sandbox.

Block it everywhere

vet-skills block memtrace
--org acme --reason "v_4eff"