Skills/npm/memtrace

memtrace@1.2.19

CAUTION· install only

Publisher claims: "Code intelligence graph — MCP server + AI agent skills + visualization UI" Observed in sandbox: calls registry.npmjs.org only, touches nothing outside the project, writes no memory.

Registry npm (MCP server)Publisher syncable-dev · publishing for 216 daysInstalls 5,658Last detonated 3d ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-11 and scored it 63/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Access to sensitive file paths; Privileged sudo command; Access to sensitive file paths. Summary: calls registry.npmjs.org only, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 16 s · 2 scenarios
t+CategoryObserved action
11sfilesystemread ~/.memtrace/gpu/ort-1.26.0-cuda12-v1/linux-x64/installed.json outside project
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11sprocessexec /app/apps/web/node_modules/.bin/npm
11sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/npm
11sprocessexec /app/node_modules/.bin/npm
11sprocessexec /pnpm/npm
11sprocessexec /usr/local/sbin/npm
11sprocessexec /usr/local/bin/npm
11sprocessexec /app/apps/web/node_modules/.bin/nvidia-smi
11sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/nvidia-smi
11sprocessexec /app/node_modules/.bin/nvidia-smi
11sprocessexec /pnpm/nvidia-smi
11sprocessexec /usr/local/sbin/nvidia-smi
11sprocessexec /usr/local/bin/nvidia-smi
11sprocessexec /usr/sbin/nvidia-smi
11sprocessexec /usr/bin/nvidia-smi
11sprocessexec /sbin/nvidia-smi
11sprocessexec /bin/nvidia-smi
11sprocessexec /usr/lib/wsl/lib/nvidia-smi
11sprocessexited 2: memtrace: re-run with --yes (or set MEMTRACE_INSTALL_YES=1) to approve these changes.
11sfilesystemread ~/.memtrace/gpu/ort-1.26.0-cuda12-v1/linux-x64/installed.json outside project
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11snetworkCONNECT tcp://registry.npmjs.org:443
11sprocessexec /app/apps/web/node_modules/.bin/nvidia-smi
11sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/nvidia-smi
11sprocessexec /app/node_modules/.bin/nvidia-smi
11sprocessexec /pnpm/nvidia-smi
11sprocessexec /usr/local/sbin/nvidia-smi
11sprocessexec /usr/local/bin/nvidia-smi
11sprocessexec /usr/sbin/nvidia-smi
11sprocessexec /usr/bin/nvidia-smi
11sprocessexec /sbin/nvidia-smi
11sprocessexec /bin/nvidia-smi
11sprocessexec /usr/lib/wsl/lib/nvidia-smi
11sprocessexited 2: memtrace: re-run with --yes (or set MEMTRACE_INSTALL_YES=1) to approve these changes.
11sprocessscript backend runs setup only
11sprocessscript backend runs setup only
15sprocesssecond launch, clock +45 days, CI unset
15sfilesystemread ~/.memtrace/gpu/ort-1.26.0-cuda12-v1/linux-x64/installed.json outside project
15sprocessexec /app/apps/web/node_modules/.bin/nvidia-smi
15sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/nvidia-smi
15sprocessexec /app/node_modules/.bin/nvidia-smi
15sprocessexec /pnpm/nvidia-smi
15sprocessexec /usr/local/sbin/nvidia-smi
15sprocessexec /usr/local/bin/nvidia-smi
15sprocessexec /usr/sbin/nvidia-smi
15sprocessexec /usr/bin/nvidia-smi
15sprocessexec /sbin/nvidia-smi
15sprocessexec /bin/nvidia-smi
15sprocessexec /usr/lib/wsl/lib/nvidia-smi
15sprocessexited 2: memtrace: re-run with --yes (or set MEMTRACE_INSTALL_YES=1) to approve these changes.
15sfilesystemread ~/.memtrace/gpu/ort-1.26.0-cuda12-v1/linux-x64/installed.json outside project
15sprocessexec /app/apps/web/node_modules/.bin/nvidia-smi
15sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/nvidia-smi
15sprocessexec /app/node_modules/.bin/nvidia-smi
15sprocessexec /pnpm/nvidia-smi
15sprocessexec /usr/local/sbin/nvidia-smi
15sprocessexec /usr/local/bin/nvidia-smi
15sprocessexec /usr/sbin/nvidia-smi
15sprocessexec /usr/bin/nvidia-smi
15sprocessexec /sbin/nvidia-smi
15sprocessexec /bin/nvidia-smi
15sprocessexec /usr/lib/wsl/lib/nvidia-smi
15sprocessexited 2: memtrace: re-run with --yes (or set MEMTRACE_INSTALL_YES=1) to approve these changes.

Static findings

HIGH
Access to sensitive file pathsinstaller/dist/transformers/codex.js:65 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (tableName === `mcp_servers."${MCP_SERVER_NAME}".env`)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandbin/memtrace.js:465 · Privileged sudo command — agent may execute with elevated privileges// Upgrade elevation (whether `memtrace install` needs sudo on THIS install)Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsinstaller/dist/transformers/codex.js:63 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesif (tableName === `mcp_servers.${MCP_SERVER_NAME}.env`)Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Privileged sudo commandbin/memtrace.js:342 · Privileged sudo command — agent may execute with elevated privilegesconsole.error("memtrace install: retry with `sudo memtrace install`.");Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsinstaller/dist/transformers/codex.js:103 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst isEnv = name === `mcp_servers.${MCP_SERVER_NAME}.env`Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsinstaller/dist/transformers/codex.js:104 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files|| name === `mcp_servers."${MCP_SERVER_NAME}".env`;Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsinstaller/dist/rail-hook.js:199 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, MEMTRACE_RAIL_SEARCH_URL: `http://127.0.0.1:${runtime.port}` },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathsinstall.js:250 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst next = { ...env };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
HIGH
Access to sensitive file pathshooks/userprompt-claude.sh:271 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files…line in one round-trip. Fall back to Read/Grep/Glob only for: (a) config files (.env, package.json, README, raw JSON/YAML/TOML), (b) file inventory questions, (c) p…Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagebin/memtrace.js:45 · npx invocation of non-well-known package — may execute untrusted code// from npx / a supervisor / a terminal close killed the Node shim butFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/child-supervisor.js:19 · npx invocation of non-well-known package — may execute untrusted code// npx / Warp / supervisors.Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packagelib/auto-setup.js:165 · npx invocation of non-well-known package — may execute untrusted code// its hint (e.g. from an editor's `npx memtrace@latest mcp`) —Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commanduninstall.js:614 · Process kill command — agent can terminate processes// `run` is injectable so tests can check the kill commands without runningFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandinstaller/dist/rail-runtime.d.ts:25 · Process kill command — agent can terminate processes/** Grep enrichment's hook kill (design section 10): the hook never waits longer. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandlib/child-supervisor.js:69 · Process kill command — agent can terminate processes* are installed but never kill the child.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packagebin/memtrace.js:41 · npx invocation of non-well-known package — may execute untrusted code// ─── Signal-forwarding supervisor (the "npx memtrace start isn't working" fix) ──Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandlib/child-supervisor.js:28 · Process kill command — agent can terminate processes// doesn't leak listeners / kill a reaped PID).Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandinstaller/dist/rail-runtime.js:59 · Process kill command — agent can terminate processes/** Grep enrichment's hook kill (design section 10): the hook never waits longer. */Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandlib/auto-setup.js:83 · Privileged sudo command — agent may execute with elevated privileges* `sudo memtrace …` keeps the invoking user's HOME on macOS (and whereverFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandlib/upgrade-elevation.js:66 · Privileged sudo command — agent may execute with elevated privilegesreturn needsElevation(options) ? "sudo memtrace install" : "memtrace install";Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commanduninstall.js:652 · Process kill command — agent can terminate processes// /T = also kill child processes (file watchers, embed-worker childrenFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathslib/auto-setup.js:606 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesenv: { ...env, MEMTRACE_AUTO_SETUP_HOME: home, MEMTRACE_AUTO_SETUP_CWD: cwd },Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagelib/child-supervisor.js:18 · npx invocation of non-well-known package — may execute untrusted code// cause of the "`npx memtrace@latest start` isn't working" reports underFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Privileged sudo commandlib/update-banner.js:280 · Privileged sudo command — agent may execute with elevated privileges` ${elevation.parentDir} is not writable by this user, so npm needs sudo to replace the package.`,Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionlib/setup-state.js:27 · File type combined with upload action — agent may exfiltrate local data files// ~/.memtrace/setup-refresh.log output of the most recent launcher-run setupFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
HIGH
Privileged sudo commandlib/update-banner.js:567 · Privileged sudo command — agent may execute with elevated privileges`${indent}Retry with: ${style("sudo memtrace install", caps, ANSI.bold)}\n\n`Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathslib/accelerator-runtime.js:42 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filesconst result = { ...env };Fix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
npx invocation of non-well-known packagebin/memtrace.js:704 · npx invocation of non-well-known package — may execute untrusted code// `npx memtrace@latest start`, a supervisor SIGTERM or terminal closeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actioninstall.js:707 · File type combined with upload action — agent may exfiltrate local data files// setup made before ~/.memtrace/rail.json existed (< 1.2.0), put the RailFix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packagelib/auto-setup.js:161 · npx invocation of non-well-known package — may execute untrusted code// launcher (a downgrade, a second install, an npx cache) mustFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Process kill commandlib/child-supervisor.js:88 · Process kill command — agent can terminate processesif (child && typeof child.kill === "function" && child.pid != null) {Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Unpinned dependencylib/install-consent.js:184 · Unpinned dependency* (`memtrace install`, `npm i -g memtrace@latest`) stay friction-freeFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
LOW
Unpinned dependencyuninstall.js:510 · Unpinned dependency// it during `npm install -g memtrace@latest`. That is an upgrade, not a userFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06
LOW
Instructs the agent to modify its persistent memory or instruction fileslib/claude-integration.js:45 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileFor your own Claude Code directives, edit CLAUDE.md instead. -->Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction fileslib/claude-integration.js:76 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction fileCustomized content is preserved. Add personal Claude Code rules in CLAUDE.md.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction fileslib/project-directive.js:80 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file* Add or refresh the Memtrace directive in a project CLAUDE.md.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction fileslib/project-directive.js:162 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file* Write the directive into `<dir>/CLAUDE.md`, creating the file if needed.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesinstall.js:522 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file// - add a breadcrumb block to ~/.claude/CLAUDE.md if it existsFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesbin/memtrace.js:136 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file" install write the Memtrace routing directive into the project's CLAUDE.md\n" +Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Unpinned dependencybin/memtrace.js:289 · Unpinned dependency// `npm install memtrace@latest` over it would downgrade. Past latest it cameFix: Pin the exact version (`[email protected]`, `==1.2.3`) so every install gets the bytes that were reviewed.
AST06

Cost to the agent

Instructions loaded
≈43 tok
1 file · 81 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

No advisories in OSV for memtrace@1.2.19 as of 3d ago. This is the package itself, not its dependencies.

What would make this Verified

17 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim syncable-dev: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  3. Unpinned dependencies≈ +4 on the totalPin exact versions (and ideally hashes) in package.json, requirements or the install script so the bundle cannot change under you.
  4. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  5. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to npm, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim syncable-devPropose a patch to the maintainer