owlmem@0.7.6
OwlMem command line: connect your AI apps to OwlMem in one command (npx -y owlmem install), an end-to-end encrypted vault for your AI agents, and a local MCP server.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe source supports conditional exposure of an existing credential to an operator-configured endpoint, so a warning is appropriate. The default recipient is package-aligned, and the inspected source does not establish covert collection or malicious intent.
Static reason
One or more suspicious static signals were detected.
Trigger
An operator sets OWLMEM_URL to another host and invokes a CLI or MCP operation that makes a request.
Impact
The configured host could receive a token usable to access the OwlMem account.
Mechanism
The request helper sends the token from the environment or local configuration in a bearer authorization header to the configured base URL.
AI rationale
The source supports conditional exposure of an existing credential to an operator-configured endpoint, so a warning is appropriate. The default recipient is package-aligned, and the inspected source does not establish covert collection or malicious intent.
Evidence
owlmem.mjs
Network endpoints1
owlmem.com
Decision evidence
public snapshotAI called this Suspicious at 88.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- The client defaults to https://owlmem.com, but OWLMEM_URL can replace the request base; requests send the token from OWLMEM_TOKEN or local configuration as a bearer credential.
- Credential-bearing calls support vault operations, MCP requests, and a command wrapper that loads user-selected vault values into a child process environment. These are runtime operations, not install hooks.
- The manifest exposes owlmem.mjs as a CLI and declares no lifecycle scripts.
Evidence against
- The inspected source does not show a hidden package-selected recipient: the default host is the OwlMem service, while another destination requires the operator to set OWLMEM_URL.
- The reviewed callers use the shared request helper for vault and user-invoked client operations; no automatic install-time credential transfer is shown.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Source & flagged code
7 flaggedowlmem.mjsView file
40import { fileURLToPath } from "node:url";
L41: import { spawn, spawnSync } from "node:child_process";
L42:
High
435inputSchema: { type: "object", properties: {
L436: command: { type: "string", description: "Shell command to run (sh -c)" },
L437: env: { type: "object", description: 'Map of ENV_VAR to "item" or "item:field", e.g. {"DB_PASSWORD": "prod/db:password"}', additionalProperties: { type: "string" } },
High
40import { fileURLToPath } from "node:url";
L41: import { spawn, spawnSync } from "node:child_process";
L42:
L43: export const VERSION = "0.7.6";
L44: const BASE = (process.env.OWLMEM_URL || "https://owlmem.com").replace(/\/$/, "");
L45: const DIR = process.env.OWLMEM_HOME || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "owlmem");
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
owlmem.mjsView on unpkg · L40Findings
7 High3 Medium3 Low
HighChild Processowlmem.mjs
HighShellowlmem.mjs
HighSame File Env Network Executionowlmem.mjs
HighCommand Output Exfiltrationowlmem.mjs
HighSandbox Evasion Gated Capabilityowlmem.mjs
HighTrigger Reachable Command Output Exfiltrationowlmem.mjs
HighSemantic Analysis Limitedowlmem.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to owlmem@0.7.6.
See all versions of owlmem for other recorded verdicts.
- Review the evidence and your use of owlmem@0.7.6 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.