Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- context-engine.js:29
- Evidence
const raw = process.env[name];
Security audit
Lethe
Security checks for vulnerabilities and agentic risk
Overview
Lethe is a disclosed persistent-memory plugin that stores and recalls agent context through a configured Lethe server, with no evidence of hidden exfiltration or destructive behavior.
Install this only if you want an agent memory layer. Keep the endpoint local unless you intentionally trust a remote Lethe server, avoid recording secrets or sensitive personal data, and review the stored memory periodically because recalled summaries and events can influence future agent behavior.
SkillSpector was not run because this plugin release contains no bundled skills.
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- dist/context-engine.js:29
- Evidence
const raw = process.env[name];