registry / @dosx/agent-memory / 0.0.13

@dosx/agent-memory@0.0.13

Local Markdown workspace memory for AI coding agents (Cursor, Claude Code, Codex, OpenCode, Copilot, Gemini). npx CLI installs harness lifecycle hooks; install the skill with npx skills add — no server, vector DB, or embeddings.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 20.8 KB of source

Source & flagged code

3 flagged

bin/agent-memory.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2'use strict';

4const { spawnSync } = require('node:child_process');

5const fs = require('node:fs');

High

Child Process

Source & flagged code

3 flagged · loading source

bin/agent-memory.jsView file

3L4: const { spawnSync } = require('node:child_process'); L5: const fs = require('node:fs');

High

Child Process

Package source references child process execution.

bin/agent-memory.jsView on unpkg · L3

84agent-memory install <harness> # interactive menu (TTY) L85: agent-memory install skill # redirect to npx skills add L86: agent-memory help ... L96: L97: /** Always shell:false — argv must not be re-parsed by cmd.exe. */ L98: function run(command, args, options = {}) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/agent-memory.jsView on unpkg · L84

hooks/install-hooks.shView file

•path = hooks/install-hooks.sh kind = build_helper sizeBytes = 10942 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/install-hooks.shView on unpkg

Findings

3 High3 Medium1 Low

HighChild Processbin/agent-memory.js

HighShell

HighRuntime Package Installbin/agent-memory.js

MediumEnvironment Vars

MediumShips Build Helperhooks/install-hooks.sh

MediumStructural Risk Force Deep Review

LowFilesystem

Lines 64-104javascript

64 if (CANONICAL_HARNESSES.has(name)) return name;

65 return HARNESS_ALIASES[name] || null;

66}

68function isTTY() {

69 return process.stdin.isTTY === true && process.stdout.isTTY === true;

70}

72function skillsAddCommandText() {

73 return `npx --yes skills add ${REMOTE_SKILL_SOURCE} --skill agent-memory`;

74}

76function printHelp() {

77 console.log(`agent-memory ${VERSION}

79Hooks installer for @dosx/agent-memory. The skill is installed separately

80via npx skills add (not this CLI).

82Usage:

83 agent-memory install hooks <harness>

84 agent-memory install <harness> # interactive menu (TTY)

85 agent-memory install skill # redirect to npx skills add

86 agent-memory help

88Harnesses: cursor, claude (claude-code), codex, opencode, copilot (github), gemini

90Examples:

91 npx @dosx/agent-memory install hooks cursor

92 npx @dosx/agent-memory install cursor

93 npx skills add diegoos/agent-memory#${VERSION} --skill agent-memory

94`);

95}

97/** Always shell:false — argv must not be re-parsed by cmd.exe. */

98function run(command, args, options = {}) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/agent-memory.jsView on unpkg · L84

99 const result = spawnSync(command, args, {

100 stdio: 'inherit',

101 ...options,

102 shell: false,

103 });

104 if (result.error) {