owlmem@0.7.8
OwlMem command line: connect your AI apps to OwlMem in one command (npx -y owlmem install), an end-to-end encrypted vault for your AI agents, and a local MCP server.
AI Security Review
scanned 8d ago · by lpm-firewall-aiThe package has no install lifecycle hook, and its executable runs the CLI only when launched. The inspected network and command behavior serves caller-requested vault operations, with approval or an owner-enabled standing grant governing access; no concrete attack behavior was found.
Static reason
One or more suspicious static signals were detected.
Trigger
A user launches the CLI or an AI client invokes a configured MCP tool.
Impact
No unrelated secret collection, unconsented execution, persistence, or destructive action was established.
Mechanism
Vault requests send the token to the configured OwlMem service. Selected secrets can be supplied to a command requested through the CLI or MCP tool.
AI rationale
The package has no install lifecycle hook, and its executable runs the CLI only when launched. The inspected network and command behavior serves caller-requested vault operations, with approval or an owner-enabled standing grant governing access; no concrete attack behavior was found.
Evidence
package.jsonowlmem.mjs
Network endpoints1
owlmem.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest exposes a CLI binary and contains no lifecycle scripts.
- The API uses the OwlMem service by default; its bearer token comes from the environment or saved configuration and is sent with vault requests.
- Vault operations wait for server approval when required; unattended access depends on an owner-enabled standing grant.
- MCP calls retrieve or save caller-selected vault items, and vault_run supplies selected items to the requested command.
- The CLI run command takes its command and vault references from its arguments; the entrypoint calls main only when launched as the executable.
- The inspected process and network behavior is confined to these user-invoked CLI and MCP functions; no unrelated collection or transfer was identified.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flaggedowlmem.mjsView file
41import { fileURLToPath } from "node:url";
L42: import { spawn, spawnSync } from "node:child_process";
L43:
High
436inputSchema: { type: "object", properties: {
L437: command: { type: "string", description: "Shell command to run (sh -c)" },
L438: env: { type: "object", description: 'Map of ENV_VAR to "item" or "item:field", e.g. {"DB_PASSWORD": "prod/db:password"}', additionalProperties: { type: "string" } },
High
41import { fileURLToPath } from "node:url";
L42: import { spawn, spawnSync } from "node:child_process";
L43:
L44: export const VERSION = "0.7.7";
L45: const BASE = (process.env.OWLMEM_URL || "https://owlmem.com").replace(/\/$/, "");
L46: const DIR = process.env.OWLMEM_HOME || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "owlmem");
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
owlmem.mjsView on unpkg · L41Findings
7 High3 Medium3 Low
HighChild Processowlmem.mjs
HighShellowlmem.mjs
HighSame File Env Network Executionowlmem.mjs
HighCommand Output Exfiltrationowlmem.mjs
HighSandbox Evasion Gated Capabilityowlmem.mjs
HighTrigger Reachable Command Output Exfiltrationowlmem.mjs
HighSemantic Analysis Limitedowlmem.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to owlmem@0.7.8.
See all versions of owlmem for other recorded verdicts.
- Review the evidence and your use of owlmem@0.7.8 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.