owlmem@0.9.0
OwlMem command line: connect your AI apps to OwlMem in one command (npx -y owlmem install), an end-to-end encrypted vault for your AI agents, and a local MCP server.
AI Security Review
scanned 5d ago · by lpm-firewall-aiAuto-wake sends aggregated AI token-usage telemetry without disclosing that reporting in the user-facing setup materials. The collection is limited to usage counts and occurs only when auto-wake is enabled, so this warrants a warning rather than a block.
Static reason
One or more suspicious static signals were detected.
Trigger
A user enables auto-wake; its background process starts and periodically scans supported AI session logs.
Impact
OwlMem and agents in the space can see usage totals and which agents are busy. The package’s README and auto-wake prompt do not disclose this reporting.
Mechanism
The process extracts token counts from Claude Code and Codex logs, aggregates them by app and UTC day, and sends the totals to OwlMem’s wake API. The source says transcript text and paths are not sent.
AI rationale
Auto-wake sends aggregated AI token-usage telemetry without disclosing that reporting in the user-facing setup materials. The collection is limited to usage counts and occurs only when auto-wake is enabled, so this warrants a warning rather than a block.
Evidence
owlmem.mjs~/.claude/projects/**/*.jsonl~/.codex/sessions/**/*.jsonlusage.json in the OwlMem wake folder
Network endpoints1
owlmem.com/v1/wake/usage (default; OWLMEM_URL can change the base URL)
Decision evidence
public snapshotAI called this Suspicious at 93.0% confidence as Dangerous Capability with medium false-positive risk.
Evidence for warning
- Auto-wake reads Claude Code and Codex session logs, aggregates token counts by app and UTC day, and says only numbers leave the computer.
- The background auto-wake process periodically calls the usage reporting function.
- Usage reporting is sent to OwlMem’s wake API; the default host is owlmem.com.
- The README describes auto-wake but does not disclose this usage reporting.
Evidence against
- Auto-wake is off unless explicitly enabled or accepted in the install prompt; noninteractive install does not enable it by default.
- The manifest has no lifecycle scripts, and the CLI runs only when invoked as its executable.
- The reported shell execution is an MCP tool that runs a caller-supplied command with requested vault secrets; its output is masked before return.
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStrings
Source & flagged code
7 flaggedowlmem.mjsView file
41import { fileURLToPath } from "node:url";
L42: import { spawn, spawnSync } from "node:child_process";
L43:
High
436inputSchema: { type: "object", properties: {
L437: command: { type: "string", description: "Shell command to run (sh -c)" },
L438: env: { type: "object", description: 'Map of ENV_VAR to "item" or "item:field", e.g. {"DB_PASSWORD": "prod/db:password"}', additionalProperties: { type: "string" } },
High
41import { fileURLToPath } from "node:url";
L42: import { spawn, spawnSync } from "node:child_process";
L43:
L44: export const VERSION = "0.9.0";
L45: const BASE = (process.env.OWLMEM_URL || "https://owlmem.com").replace(/\/$/, "");
L46: const DIR = process.env.OWLMEM_HOME || join(process.env.XDG_CONFIG_HOME || join(homedir(), ".config"), "owlmem");
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
owlmem.mjsView on unpkg · L41Findings
7 High3 Medium3 Low
HighChild Processowlmem.mjs
HighShellowlmem.mjs
HighSame File Env Network Executionowlmem.mjs
HighCommand Output Exfiltrationowlmem.mjs
HighSandbox Evasion Gated Capabilityowlmem.mjs
HighTrigger Reachable Command Output Exfiltrationowlmem.mjs
HighSemantic Analysis Limitedowlmem.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to owlmem@0.9.0.
See all versions of owlmem for other recorded verdicts.
- Review the evidence and your use of owlmem@0.9.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.