Agent Economy ReportAgent Economy ReportSAFE version 1.0.0 · audited 2026-09-09
AgentMemory is a small, self-contained Python library that gives an AI agent a local memory: it stores facts, lessons learned and tracked entities in a SQLite database, by default at ~/.agent-memory/memory.db. All of the code only talks to that local database file using standard library modules (sqlite3, json, hashlib); there are no network calls, no shell execution, no reading of environment variables or credentials, and no external dependencies. The only URLs in the package are documentation badges, a GitHub repo link, the registry listing, and one example URL stored as a plain text attribute in a demo script. Its documentation suggests adding a short 'memory protocol' section to the agent's AGENTS.md/HEARTBEAT.md, which is an ordinary integration tip rather than an attempt to override agent rules. The main thing a careful user should note is a privacy one: whatever the agent chooses to remember (including anything sensitive it is told) is written unencrypted to disk and can be exported wholesale via export_json().
| Declared purpose | A persistent, local memory layer for AI agents to remember facts, record lessons from successes/failures, track entities (people, projects, tools), and recall them across sessions, using only Python and SQLite. |
| Observed behavior | Creates a directory ~/.agent-memory (or uses a caller-supplied path), opens/creates a SQLite database with facts, lessons, entities tables plus an FTS5 full-text index, and provides CRUD/search/export methods. Three CLI wrappers (fact.py, learn.py, entity.py) expose the same operations from the command line. Tests and an example script exercise the API against temporary databases. No outbound network traffic, no subprocess/exec, no credential or environment access anywhere in the code. |
| Verdict, rules only | SAFE |
| Verdict, AI | SAFE |
| Final verdict | SAFE (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| filesystem_write | needed | Creates ~/.agent-memory directory and writes/updates a SQLite database file there (src/memory.py lines 103-108); a custom path can be supplied. No other files are written. |
| filesystem_read | needed | Reads back its own SQLite database for recall/list/export operations; does not read any other files on the system. |
| severity | finding |
|---|---|
| info | Creates a persistent data directory in the user's home On first use the skill creates ~/.agent-memory and stores memory.db there. This is the documented, expected behavior and is limited to that one directory unless the caller passes a custom db_path. src/memory.py:104 db_dir.mkdir(exist_ok=True) |
| low | Bulk export of all stored memory export_json() dumps every fact, lesson and entity into a single dictionary. The function only returns data to the caller and never transmits it, but if an agent stores secrets or personal data, a single call surfaces all of it at once. Data is stored unencrypted in the SQLite file. src/memory.py:642 """Export all memories as JSON.""" |
| info | External URL appears only as demo data This URL is stored as a plain string attribute of an example entity. No HTTP client is imported or used anywhere in the package, so nothing is contacted. examples/basic_usage.py:66 "url": "https://datadeck-preview.vercel.app" |
| info | Suggests editing the agent's instruction files The documentation recommends the user manually add a short 'Memory Protocol' section to their agent configuration. The skill does not perform this edit itself and the suggested text only describes loading and saving memories; it contains no attempt to bypass other agent rules. SKILL.md:46 Add to your AGENTS.md or HEARTBEAT.md: |
| info | No third-party packages installed The package pulls in no external dependencies, which removes supply-chain risk from installation. requirements.txt:1 # No external dependencies - just Python stdlib |
| info | Database queries use bound parameters All SQL statements pass user-controlled values as parameters rather than string concatenation, so stored content cannot alter the queries. A malformed FTS search string could raise an sqlite3 error, which is a robustness issue rather than a security one. src/memory.py:245 WHERE facts_fts MATCH ? |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawdhub.com | not in the service index | README.md:7 |
| clawhub.ai | not in the service index | skill-card.md:7 |
| datadeck-preview.vercel.app | not in the service index | examples/basic_usage.py:66 |
| github.com | not in the service index | README.md:11 |
| img.shields.io | not in the service index | README.md:5 |
| opensource.org | not in the service index | README.md:5 |
| www.python.org | not in the service index | README.md:6 |
| Binaries invoked | bash, git, python, python3 |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
README.md | 229 | 4598c26fd23e2218… |
SKILL.md | 66 | 7de6c27f611b9abf… |
_meta.json | 6 | 3bfacb0f38fb39ce… |
cli/entity.py | 91 | 34bf34dad6b73e48… |
cli/fact.py | 86 | de3eab5852fe233a… |
cli/learn.py | 62 | 827e5700253c7546… |
examples/basic_usage.py | 104 | 2d4aee57035cb5db… |
requirements.txt | 1 | 8c0ba1c2073a16ba… |
skill-card.md | 42 | 2369bb9ab0c4b147… |
src/__init__.py | 8 | 1e54d9d2881854ff… |
src/memory.py | 687 | 296dec24ca81fc42… |
tests/test_memory.py | 197 | 4a726aa0db0ee8a5… |
For agents
JSON: https://agenteconomy.report/k/agent-memory.audit.json · badge: https://agenteconomy.report/k/agent-memory.audited.svg ·
skill rating: /k/agent-memory · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).