superlocalmemory@4.2.17
VERIFIED· install onlyPublisher claims: "The governed memory brain for AI agents: one local memory for Claude Code, Codex, Cursor, Copilot, ChatGPT and any MCP client. Honest recall, documents and pictures, roles, audit and GDPR erasure." Observed in sandbox: no network, touches nothing outside the project, writes no memory.
Registry npm (MCP server)Publisher qualixar · publishing for 279 daysInstalls 6,337Last detonated 28 h ago
Coverage
Install scripts ran; no agent task scenario for this bundle.- Tested
- install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
- Not tested
- use of the skill by an agent
What this means for the label: Verified here covers what ran. The server's tools were not exercised with a real credential, so nothing about their behavior is asserted; the credential summary below says what to do with that.
Before you give it your token
- It will ask for
- no credential variables read in the code
- Where it talks to
- no vendor host named in the codeAlso pytorch.org, python.org — not the publisher's domain; check what for before connecting.
- What the honeypot saw
- no credential files read · no network
- What we could not test
- use of the skill by an agent
Connect it under the guard. Install scripts ran; no agent task scenario for this bundle. The code names no credential variable; the guard pins the network to what the honeypot saw and logs every call.
$vet-skills run --net declared -- npx -y superlocalmemory
Never paste a credential into a chat, a ticket or a report, including ours. How the guard holds it.
Is [email protected] safe to install?
KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-13 and scored it 83/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.
Behavior trace
Honeypot run · 1 s · 2 scenarios · 0 deviationst+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.2sprocessexec /app/apps/web/node_modules/.bin/python3.14
0.2sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/python3.14
0.2sprocessexec /app/node_modules/.bin/python3.14
0.2sprocessexec /pnpm/python3.14
0.2sprocessexec /usr/local/sbin/python3.14
0.2sprocessexec /usr/local/bin/python3.14
0.2sprocessexec /usr/sbin/python3.14
0.2sprocessexec /usr/bin/python3.14
0.2sprocessexec /sbin/python3.14
0.2sprocessexec /bin/python3.14
0.2sprocessexec /app/apps/web/node_modules/.bin/python3.13
0.2sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/python3.13
0.2sprocessexec /app/node_modules/.bin/python3.13
0.2sprocessexec /pnpm/python3.13
0.2sprocessexec /usr/local/sbin/python3.13
0.2sprocessexec /usr/local/bin/python3.13
0.2sprocessexec /usr/sbin/python3.13
0.2sprocessexec /usr/bin/python3.13
0.2sprocessexec /sbin/python3.13
0.2sprocessexec /bin/python3.13
0.2sprocessexec /app/apps/web/node_modules/.bin/python3.12
0.2sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/python3.12
0.2sprocessexec /app/node_modules/.bin/python3.12
0.2sprocessexec /pnpm/python3.12
0.2sprocessexec /usr/local/sbin/python3.12
0.2sprocessexec /usr/local/bin/python3.12
0.2sprocessexec /usr/sbin/python3.12
0.2sprocessexec /usr/bin/python3.12
0.2sprocessexec /sbin/python3.12
0.2sprocessexec /bin/python3.12
0.2sprocessexited 1: it never installs packages into your system Python.
0.2sprocessscript backend runs setup only
0.2sprocessscript backend runs setup only
0.2sprocesssecond launch, clock +45 days, CI unset
0.4sprocessexec /app/apps/web/node_modules/.bin/python3.14
0.4sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/python3.14
0.4sprocessexec /app/node_modules/.bin/python3.14
0.4sprocessexec /pnpm/python3.14
0.4sprocessexec /usr/local/sbin/python3.14
0.4sprocessexec /usr/local/bin/python3.14
0.4sprocessexec /usr/sbin/python3.14
0.4sprocessexec /usr/bin/python3.14
0.4sprocessexec /sbin/python3.14
0.4sprocessexec /bin/python3.14
0.4sprocessexec /app/apps/web/node_modules/.bin/python3.13
0.4sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/python3.13
0.4sprocessexec /app/node_modules/.bin/python3.13
0.4sprocessexec /pnpm/python3.13
0.4sprocessexec /usr/local/sbin/python3.13
0.4sprocessexec /usr/local/bin/python3.13
0.4sprocessexec /usr/sbin/python3.13
0.4sprocessexec /usr/bin/python3.13
0.4sprocessexec /sbin/python3.13
0.4sprocessexec /bin/python3.13
0.4sprocessexec /app/apps/web/node_modules/.bin/python3.12
0.4sprocessexec /root/.cache/node/corepack/v1/pnpm/10.28.0/dist/node-gyp-bin/python3.12
0.4sprocessexec /app/node_modules/.bin/python3.12
0.4sprocessexec /pnpm/python3.12
0.4sprocessexec /usr/local/sbin/python3.12
0.4sprocessexec /usr/local/bin/python3.12
0.4sprocessexec /usr/sbin/python3.12
0.4sprocessexec /usr/bin/python3.12
0.4sprocessexec /sbin/python3.12
0.4sprocessexec /bin/python3.12
0.4sprocessexited 1: it never installs packages into your system Python.
Static findings
LOW
Instructs the agent to modify its persistent memory or instruction filescodex-plugin/README.md:53 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01`codex-plugin/AGENTS.md` are not written for you: append them to your `AGENTS.md`Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filescodex-plugin/README.md:65 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01Codex reads `AGENTS.md` from the repo root. Append the contents of `codex-plugin/AGENTS.md`Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Process kill commandplugin-src/commands/slm-loop.md:30 · Process kill command — agent can terminate processes
AST05`HALT` (a bound tripped), `PAUSE` (approval pending), `KILLED` (kill switch),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandplugin/commands/slm-loop.md:30 · Process kill command — agent can terminate processes
AST05`HALT` (a bound tripped), `PAUSE` (approval pending), `KILLED` (kill switch),Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/postinstall.js:257 · Privileged sudo command — agent may execute with elevated privileges
AST05lines.push('Ubuntu 22.04: sudo add-apt-repository ppa:deadsnakes/ppa && sudo apt install python3.12 python3.12-venv');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.MEDIUM
Process kill commandplugin/skills/slm-loop/SKILL.md:119 · Process kill command — agent can terminate processes
AST05| `KILLED` | The external kill switch tripped between laps. |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.HIGH
Privileged sudo commandscripts/postinstall.js:256 · Privileged sudo command — agent may execute with elevated privileges
AST05lines.push('Debian 13 / Ubuntu 24.04 and later: sudo apt install python3 python3-venv');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.LOW
Refusal suppressionCHANGELOG.md:738 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction file
AST01## [4.2.2] — Recall never refuses answers it has after a model change, and "What am I working on?" answers from your workFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.LOW
Instructs the agent to modify its persistent memory or instruction filescodex-plugin/README.md:63 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file
AST01### 1 — Append the SLM rules to your `AGENTS.md`Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Python subprocess execution detectedhermes-plugin/__init__.py:413 · Python subprocess execution detected
AST05completed = subprocess.run([binary, *argv], text=True, capture_output=True, timeout=30, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.LOW
Refusal suppressionCHANGELOG.md:1517 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction file
AST01- **Saves under heavy load are accepted and saved**, never refused. A save theFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.MEDIUM
Python subprocess execution detectedhermes-plugin/__init__.py:107 · Python subprocess execution detected
AST05completed = subprocess.run([binary, "--version"], text=True, capture_output=True, timeout=5, check=False)Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.MEDIUM
File type combined with upload actionscripts/postinstall.js:333 · File type combined with upload action — agent may exfiltrate local data files
AST07console.log('Usage: node scripts/postinstall.js');Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.MEDIUM
Process kill commandplugin/skills/slm-loop/SKILL.md:105 · Process kill command — agent can terminate processes
AST05- **kill switch** — a non-empty `SLM_LOOP_KILL` in the loop's processFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.LOW
Refusal suppressionREADME.md:305 · Refusal suppression — attempting to prevent safety responses · informational: not an instruction file
AST01…eceipt; failures keep the evidence and retry; text saves under load are queued, never refused | [Architecture](https://github.com/qualixar/superlocalmemory/blob/main/docs/A…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.HIGH
Privileged sudo commandscripts/postinstall.js:258 · Privileged sudo command — agent may execute with elevated privileges
AST05lines.push('Fedora / RHEL 9: sudo dnf install python3.12');Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.Cost to the agent
Instructions loaded
≈15,726 tok
4 files · 80 in bundle
Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.
Known vulnerabilities
No advisories in OSV for superlocalmemory@4.2.17 as of 27 h ago. This is the package itself, not its dependencies.