Chatgpt Memory Extraction

• Outcome: Review
• Latest audit: Sep 15, 2026 · 12:49 AM UTC
• Version: 1.0.1

Overview

The skill appears purpose-built rather than malicious, but it creates a durable, searchable archive of highly sensitive ChatGPT history and third-party personal details without enough privacy scoping or safeguards.

Review before installing if you are comfortable turning your full ChatGPT export into plaintext local files, people profiles, direct quotes, emotional summaries, and topic indexes. Use a private or encrypted workspace, avoid cloud-synced folders unless intentional, redact sensitive and third-party information, review outputs before sharing or importing into another assistant, and prefer pinned or verified install sources.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: README.md:30

Finding

Unpinned npm CLI Installation Exposes Users to Supply-Chain Code Execution

Content

View full analysis

Remediation

View remediation

install chatgpt-memory-extraction ``` 2. Document the expected package publisher, version, and package integrity hash so users can verify the downloaded artifact. 3. Prefer a lockfile-backed installation workflow using `npm ci`, with exact dependency versions and integrity metadata committed to the project. 4. Pin the manual Git installation to a reviewed commit or signed tag: ```bash git clone https://github.com/cyresearch/chatgpt-memory-extraction.git cd chatgpt-memory-extraction git checkout --detach ``` 5. Publish and verify signed release artifacts where possible, and document a checksum verification procedure. 6. Apply the same hardened instructions consistently to `README.md`, `README.zh-CN.md`, and `README.ja.md`. 7. Advise users not to run installation commands with elevated privileges and to execute third-party installers in a restricted environment where practical. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (14)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill promises deep memory extraction, people profiling, emotion/theme identification, and timeline generation, but the described behavior appears limited to conversion and manual review workflows. This mismatch is dangerous because users may trust the skill to perform sensitive semantic analysis accurately or comprehensively when it may not, leading to overcollection, incorrect inferences, or unsafe reliance on incomplete processing of personal history.

Content

No source excerpt is available for this finding.

Context Leakage

High

• Category: Data Exfiltration
• Confidence: 75% confidence

Finding

Code or instructions that leak agent conversation context to external services, potentially exposing sensitive user interactions.

Content

Scanner excerpt · scripts/extract_conversations.py (reported line 3)May include surrounding context.

python

#!/usr/bin/env python3
"""
Extract conversations from ChatGPT export JSON files into readable text files.

Usage:
    python extract_conversations.py <input_dir> <output_dir> [--year YYYY] [--quarter Q1|Q2|Q3|Q4]

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README explicitly encourages processing years of ChatGPT export data containing deeply personal memories, relationships, emotions, and life events, but does not prominently warn about the sensitivity of that data or recommend privacy safeguards. In this context, users may expose highly sensitive personal information to the tool, downstream assistants, or generated archives without understanding retention, access, redaction, or sharing risks.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This skill is explicitly designed to process years of exported ChatGPT conversations and repurpose them into a searchable memory archive, but the README does not prominently warn that these exports may contain highly sensitive personal, relational, health, financial, or confidential data. In this context, users may underestimate privacy exposure and feed intimate archives into local agents or other AI systems, increasing the chance of secondary disclosure or over-retention.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 89% confidence

Finding

The README instructs users to run npx clawhub install ... without pinning a specific version, which can fetch and execute whatever package version is current at install time. That creates a supply-chain risk: a compromised or malicious upstream release could be executed on the user's machine during installation.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

This skill is specifically designed to process exported ChatGPT conversations and materialize them into a structured local archive containing timelines, people profiles, topics, and raw conversation text. Because that data is highly sensitive personal content, failing to clearly warn users that large volumes of intimate conversation history will be written to local files increases the risk of accidental exposure through backups, sync tools, shared machines, or weak filesystem permissions.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence

Finding

The skill instructs use of local scripts and handling of exported conversation files, which implies file read/write behavior, but it does not declare any explicit tool scope or permissions boundary. In a skill that processes sensitive personal chat exports, missing scope increases the chance an agent reads or writes beyond what the user expects, reducing auditability and consent clarity.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill tells users to export and process full ChatGPT conversation history, which can contain highly sensitive personal, professional, medical, financial, or third-party information, yet it lacks a direct privacy warning in the main skill description. In this context, omission of privacy guidance materially increases the risk of exposing intimate data during extraction, storage, review, and subsequent reuse.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Building person profiles and raw conversation archives from chat exports creates a secondary indexed repository of personal and third-party data, amplifying exposure and making correlation easier than in the original source material. In the context of a memory-extraction skill, this is especially sensitive because it systematizes identities, relationships, and historical interactions into durable files that may outlive the user's original intent for the data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Line L055 explicitly instructs authors to 'Use the user's primary language.' This is a natural-language locale policy constraint that forces language selection without user opt-in or an offered alternative, which falls under the language/locale policy violation category.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The specification explicitly instructs the system to preserve detailed conversation content, direct quotes, emotional state, life events, and other sensitive personal data in structured files. This increases privacy risk by concentrating highly sensitive user and third-party information into searchable, persistent artifacts that can be over-retained, copied, or exposed beyond the original chat context.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

The README describes generating timelines, people profiles, topic files, and raw conversation text outputs, but it does not clearly warn that the skill writes extensive derived local files containing private conversation content. That omission can lead users to leave sensitive plaintext archives on disk without realizing how much data is being duplicated and organized for easy access.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.