pensyve — agentic threat model

Not certain from the listing — relies on Claude Code's underlying foundation models (Anthropic Claude series). Threats include prompt injection bypassing memory boundaries and adversarial inputs designed to manipulate the memory-curator agents.

Directly manages cross-session entity-aware memory and conversation state. Highly vulnerable to memory poisoning, unauthorized data exfiltration of historical session states, and lack of clear data lineage across persistent sessions.

Provides the core orchestration for memory curation, lifecycle hooks, and skills. Vulnerabilities include insecure tool integration via custom commands, memory-curator agent manipulation, and execution of unauthorized lifecycle hooks.

Not certain from the listing — runs locally or in the environment hosting Claude Code. Threats include insecure local storage of persistent memory files, lack of sandboxing for lifecycle hook execution, and exposed local state files.

Not certain from the listing — no built-in evaluation, logging, or guardrails are described. This creates a blind spot where malicious memory modifications or unauthorized state restorations go undetected.

Not certain from the listing — lacks explicit access controls, encryption-at-rest for stored memories, or compliance auditing for sensitive data retained across user sessions.

Features dedicated 'memory-curator agents' that interact with the main agent runtime. This introduces agent-to-agent trust abuse, where a compromised curator agent can corrupt the global memory state of other active agents.