This plugin captures tool input and output verbatim and stores it locally in the agentmemory server. The threat model assumes:

• Trusted host: the agentmemory server runs on the same machine as Zcode (default: http://localhost:3111). It is not exposed to the network.
• Trusted user: you are the only person with shell access to your machine.
• Untrusted tool output: anything the agent reads or writes is untrusted. Treat tool outputs as potentially malicious (prompt injection, exfiltration attempts).

Out of scope:

• Compromised agentmemory server (this is the storage backend, not the plugin).
• Network attackers who can sniff localhost traffic (assumed impossible).
• Physical access to the machine.

1. No network calls. All HTTP traffic goes to AGENTMEMORY_URL, which defaults to localhost:3111. The plugin never phones home.
2. No code execution on captured data. Tool output is stored as a string. The plugin never evals or executes captured content.
3. No shell expansion. Captured environment variables are quoted properly before being used.
4. Bounded runtimes. Every hook has a 3-second HTTP timeout and a 500-millisecond self-exit. A misbehaving server cannot block the agent.

1. Secrets in .env. If you put AGENTMEMORY_SECRET in a committed .env file, the secret leaks. Use .gitignore.
2. Tool input. Some tools accept secrets as arguments (e.g. Bash with curl -H "Authorization: Bearer ..."). Those secrets end up in observations. Review your tool inputs.
3. Tool output. Some tools return secrets (e.g. cat ~/.aws/credentials). Those secrets end up in observations. Be careful which tools you run.
4. Project scoping. If you set AGENTMEMORY_PROJECT_NAME, make sure it makes sense — otherwise observations from one project may be visible from another.
5. Server exposure. If you bind agentmemory serve to a non-loopback address, anyone on the network can read your memory. Bind to localhost unless you know what you are doing.

Before committing changes or sharing the contents of your memory store:

• No gho_*, ghp_*, github_pat_* tokens in any .json, .mjs, .md, .sh, .cmd file.
• No sk-* API keys in any committed file.
• No AGENTMEMORY_SECRET=... with a non-empty value in any committed file.
• No real session IDs (sess_<uuid> from your actual sessions) in examples.
• No real file paths from your machine (/Users/your-name/...) in examples — use /Users/dev/app style placeholders.

Run this one-liner to audit:

grep -rE '(gho_|ghp_|github_pat_|sk-[a-zA-Z0-9]{20,}|AGENTMEMORY_SECRET=[^[:space:]]{5,})' \
  --include='*.mjs' --include='*.json' --include='*.md' --include='*.sh' --include='*.cmd' .

If it prints anything, fix it before committing.

If you discover a security issue, please report it privately:

• Email: open a private security advisory on GitHub.
• What to include: a description of the issue, steps to reproduce, the impact, and (if known) a suggested fix.
• Response time: within 7 days. Critical issues are patched within 30 days.

Do not file a public issue for security problems. Public disclosure before a fix is available helps attackers more than users.

No vulnerabilities reported yet. Be the first — responsibly.