Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Elite Longterm Memory Backup

v1.0.0

Ultimate AI agent memory system for Cursor, Claude, ChatGPT & Copilot. WAL protocol + vector search + git-notes + cloud backup. Never lose context again. Vib...

0· 120·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The code and SKILL.md implement a local memory system (SESSION-STATE.md, MEMORY.md, memory/ daily logs) and point to LanceDB, git-notes, and optional cloud services. Requiring OPENAI_API_KEY is reasonable for an OpenAI-backed memorySearch provider. However, the package and docs also recommend optional services (Mem0, SuperMemory) that would require additional credentials; those are not listed as required in the registry metadata.
Instruction Scope
Runtime instructions and CLI operate on the workspace (create SESSION-STATE.md, MEMORY.md, memory/<date>.md) and suggest editing agent/plugin configs (e.g., ~/.openclaw/openclaw.json, ~/.clawdbot/clawdbot.json). SKILL.md also contains snippets showing use of SUPERMEMORY_API_KEY and MEM0_API_KEY (external services). The instructions do not direct reading of unrelated system files, but they do instruct transmitting data to optional cloud endpoints (Mem0, SuperMemory) which could expose sensitive memory if enabled.
Install Mechanism
This is instruction-first with one small CLI JS file included; there is no install script that downloads arbitrary archives or runs remote code. package.json lists mem0ai as an optional dependency (npm) but nothing is auto-downloaded by the skill metadata. Install risk is low if you don't run 'npm install' for optional deps.
!
Credentials
Registry metadata declares OPENAI_API_KEY as the required env var (reasonable). But SKILL.md demonstrates and suggests exporting SUPERMEMORY_API_KEY and MEM0_API_KEY for optional cloud sync/auto-extraction. Those additional credentials are not declared as required by the registry. The skill could send user memory to external services if those optional keys are provided—this is a data exposure risk and should be explicitly disclosed in metadata.
Persistence & Privilege
The skill is not marked always:true and does not request system-wide privileges. Its CLI writes files inside the current workspace and checks for a LanceDB path under the user's HOME; it does not modify other skills or global agent configs arbitrarily. Autonomy settings are default.
What to consider before installing
What to consider before installing: - Verify provenance: the registry metadata, SKILL.md, package.json, and _meta.json show inconsistent versions/IDs and 'Source: unknown' — confirm the publisher and repository (the package.json points to a GitHub repo; inspect it) before trusting the skill. - Local files: the CLI will create SESSION-STATE.md, MEMORY.md, and memory/<date>.md in whatever directory you run it from. These will contain potentially sensitive decisions and context—add them to .gitignore or store them encrypted if needed. - Optional cloud services: SKILL.md demonstrates Mem0 and SuperMemory usage. If you set MEM0_API_KEY or SUPERMEMORY_API_KEY, those services will receive extracted memories. Only provide keys if you trust the service and reviewed its privacy policy; treat those as high-sensitivity credentials. - Minimal privileges: the included bin/elite-memory.js is small and only reads/writes local files and checks a path under HOME; review its code (already included) before running. Avoid installing optional dependencies (mem0ai) unless you intentionally want remote auto-extraction. - Plugin configuration: enabling LanceDB or other agent plugins may require additional configuration/keys—check what data will be sent to OpenAI or other providers when enabling memorySearch. - If you need more assurance: ask the publisher for a signed release or a well-known repository URL, or request that the skill explicitly list optional external env vars (MEM0_API_KEY, SUPERMEMORY_API_KEY) in its registry metadata so their usage is visible up front.

Like a lobster shell, security has layers — review code before you run it.

latestvk9755541gch4931jpf80gw98vh832xzk

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🧠 Clawdis
EnvOPENAI_API_KEY

Comments