feat: add Agent Memory Guard plugin 0.0.1

[vgudur-dev]

Plugin Submission

Plugin information

• Author: Vaishnavi Gudur (vgudur-dev)
• Plugin name: Agent Memory Guard
• Version: 0.0.1
• Source repository: https://github.com/OWASP/www-project-agent-memory-guard
• Contact: https://github.com/OWASP/www-project-agent-memory-guard/issues

Submission type

• New plugin
• Version update

What changed

Adds a credential-free Dify tool plugin that screens a proposed durable-memory write before a workflow persists it. The tool returns safe_to_persist, action, severity, detector, message, and memory_key so a workflow can branch before a database, vector store, or other durable-memory component is called.

The plugin is deliberately narrow: it does not automatically intercept all Dify conversation-memory features. Workflow authors must place Screen Proposed Memory Write immediately before the write boundary they intend to protect.

Risk level

• Low risk
• Medium risk
• High risk

Required checks

• I have read and followed the Marketplace submission requirements.
• I have read and comply with the Plugin Developer Agreement.
• I tested this plugin on Dify Community Edition and Dify Cloud, or documented any limitation below.
• The package contains only files needed at runtime.
• The package does not contain secrets, local credentials, .env files, .git directories, virtual environments, caches, logs, or IDE files.
• The package does not contain executables or bundled binaries, or I explained why they are required below.
• The plugin README includes setup steps, usage instructions, required APIs or credentials, connection requirements, and the source repository link.
• The plugin includes PRIVACY.md and manifest.yaml references it.
• All user-facing text is primarily in English.

Security and privacy notes

Low risk. The plugin is local-only: it has no credentials, network requests, telemetry, external APIs, file operations, arbitrary URL fetching, code execution, or bundled executables. It processes only the proposed memory key, content, provenance label, and optional task identifier inside the Dify plugin runtime. The host Dify deployment's own logging and retention settings remain the administrator's responsibility.

Local validation

PYTHONPATH=/home/ubuntu/amg-dify-plugin uv run --with pytest --with agent-memory-guard pytest -q returned 2 passed. Benign external content returns allow, while a representative prompt-injection payload returns block with detector prompt_injection.

The package archive was inspected with unzip -t and contains only runtime files. The plugin has not been installed in a Dify Community Edition or Dify Cloud instance in this submission; the required integration point is documented in the README, and reviewer testing in the target Dify runtime is requested.

Reviewer notes

This is a workflow-level pre-persistence screen, not an end-to-end security guarantee or an OWASP certification. It depends on agent-memory-guard==0.3.0 and dify_plugin>=0.5.0, and does not require any API key.