Security audit
@lightharu/agentbrain
Security checks across malware telemetry and agentic risk
Overview
AgentBrain appears purpose-built rather than malicious, but it persistently stores and reuses sensitive conversation-derived memory and relationship/emotional profiles by default.
Install only if you explicitly want long-term local memory and personality/emotion profiling for your agent. Review the brainDir location, disable promptInjection or emotion/skill/reflection tracking if not needed, avoid sharing secrets or regulated data while it is enabled, and periodically inspect or delete the stored SQLite/vector data. Expect a possible HuggingFace model download on first embedding use.
VirusTotal
61/61 vendors flagged this plugin as clean.
Static analysis
No suspicious patterns detected.