Elite Longterm Memory 1.2.3

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:31 PM UTC
• Version: 1.0.0

Overview

This memory skill is not clearly malicious, but it encourages broad persistent saving and optional cloud syncing of conversation details without enough consent, privacy, or safety controls.

Review this carefully before installing in sensitive workspaces. Use pinned package versions, avoid enabling Mem0/SuperMemory or git-notes remote sync unless you explicitly want conversation-derived data to leave the machine, do not store secrets or personal data in memory files, and treat the LanceDB removal command as destructive.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: package.json:35

Finding

Unused Optional Dependency Introduces Avoidable Supply-Chain Exposure

Content

View full analysis

Vulnerability Details

File Location: package.json:35-37
Vulnerability Type: Unnecessary third-party dependency
Risk Level: Medium

Vulnerable Code:

json

"optionalDependencies": {
  "mem0ai": "^1.0.0"
},

Technical Analysis

The package declares mem0ai as an optional dependency even though bin/elite-memory.js, the package's only executable script, neither imports nor uses it. Package managers ordinarily attempt to resolve and install optional dependencies unless users explicitly disable that behavior.

As a result, installing or invoking this local file-initialization utility through npm can introduce mem0ai and its transitive dependency tree into the user's environment. The caret version range (^1.0.0) may also resolve to future compatible releases that were not reviewed with this package.

No evidence indicates that the currently declared dependency is malicious. The issue is the unnecessary expansion of the package's supply-chain attack surface.

Attack Path

1. A user runs npx elite-longterm-memory init or installs the package through npm.
2. npm resolves the package's optional dependencies.
3. npm downloads mem0ai and potentially its transitive dependencies, despite the CLI not requiring them.
4. A compromised future compatible release, compromised transitive dependency, or unsafe dependency lifecycle behavior executes or becomes available under the installing user's account.
5. The malicious dependency could act with the filesystem, environment, and network permissions granted to the npm process.

Impact Assessment

Exploitation depends on compromise or malicious behavior in the external dependency chain. If that occurs, code could execute with the privileges of the user running npm. The resulting scope could include access to project files, user-readable configuration and environment variables, and outbound network connectivity.

This declaration does not itsel ...[truncated 124 chars]

Remediation

View remediation

Remediation Suggestions

• Remove mem0ai from optionalDependencies, because the shipped CLI does not require it.
• Document Mem0 as a separate, explicitly installed, opt-in integration.
• If programmatic integration becomes necessary, isolate it behind a dedicated package or optional feature and load it only after explicit user consent.
• Pin an audited version rather than allowing unreviewed compatible releases through a broad range.
• Maintain and review a lockfile where applicable, inspect transitive dependencies, and use package integrity and provenance controls.
• Disable unnecessary dependency lifecycle scripts in sensitive deployment environments.

other

Warning

• Location: SKILL.md:137

Finding

Recommended Cloud Integration Can Disclose Sensitive Conversation Content

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:137-149
Additional Location: README.md:105-117, SKILL.md:334-347
Vulnerability Type: External disclosure of conversation data
Risk Level: Medium

Vulnerable Documentation and Code:

bash

npm install mem0ai
export MEM0_API_KEY="your-key"

javascript

const { MemoryClient } = require('mem0ai');
const client = new MemoryClient({ apiKey: process.env.MEM0_API_KEY });

// Conversations auto-extract facts
await client.add(messages, { user_id: "user123" });

// Retrieve relevant memories
const memories = await client.search(query, { user_id: "user123" });

Technical Analysis

The documented integration passes the complete messages collection to an external Mem0 client for processing and storage. Agent conversations can contain source code, credentials, API tokens, personal information, business data, or other confidential context.

Although the cloud integration is described as optional and requires an API key, the example does not implement data classification, secret redaction, field minimization, per-transmission confirmation, or retention and deletion controls. Users following the example may therefore cross a local-to-cloud trust boundary without understanding which data is transmitted or retained.

The executable CLI does not perform this transmission automatically. Exposure occurs only if a user or agent installs, configures, and invokes the documented external integration.

Attack Path

1. A user follows the recommended Mem0 integration instructions.
2. The user configures MEM0_API_KEY and initializes MemoryClient.
3. The application collects conversation messages, potentially including sensitive content.
4. The application invokes client.add(messages, { user_id: "user123" }).
5. The message contents leave the local environment and are processed or stored by the external provider.
6. Sensitive data may ...[truncated 649 chars]

Remediation

View remediation

Remediation Suggestions

• Clearly identify Mem0 as an external data processor and explain that submitted messages leave the local environment.
• Require explicit, informed opt-in before enabling cloud synchronization or extraction.
• Display the destination and categories of data to be transmitted before the first upload.
• Apply secret detection and redaction to API keys, passwords, tokens, private keys, and other credentials.
• Minimize transmitted data by sending only approved facts rather than complete raw conversations.
• Provide configurable allowlists and denylists for projects, message types, and sensitive data categories.
• Use per-user identifiers that do not expose unnecessary personal information.
• Document provider retention, access, encryption, deletion, and account-compromise considerations.
• Provide deletion and export procedures and recommend local-only storage for sensitive sessions.
• Update the example to obtain affirmative consent and sanitize messages before calling client.add.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill markets itself as a comprehensive durable memory system with WAL, vector search, git-notes, and cloud backup, but the file only provides documentation and setup guidance rather than implementing those controls. This mismatch is dangerous because operators may assume persistence, recall, and privacy safeguards exist when they do not, leading to unsafe reliance and accidental data handling errors.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The skill includes a destructive deletion command that recursively removes the LanceDB memory directory. Even though it is intended as maintenance, users may run it without understanding the data loss consequences, and agentic contexts can magnify risk if such commands are executed automatically.

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

md

memory_recall query="*" limit=50

# Clear all vectors (nuclear option)
rm -rf ~/.openclaw/memory/lancedb/
openclaw gateway restart

# Export Git-Notes

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

The skill includes a destructive deletion command that recursively removes the LanceDB memory directory. Even though it is intended as maintenance, users may run it without understanding the data loss consequences, and agentic contexts can magnify risk if such commands are executed automatically.

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

md

memory_recall query="*" limit=50

# Clear all vectors (nuclear option)
rm -rf ~/.openclaw/memory/lancedb/
openclaw gateway restart

# Export Git-Notes

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The README instructs users to execute the package via npx elite-longterm-memory without pinning a specific version. That causes users to fetch and run whatever version is current at execution time, creating a supply-chain risk if a malicious update or account compromise occurs; because this is a memory tool intended to run inside developer workspaces, it may gain access to sensitive code and context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

This command also uses unpinned npx execution, so the user is instructed to run remote package code at the latest published version rather than a reviewed release. In the context of an agent memory system integrated with IDEs and repositories, compromise of the package could expose workspace files, secrets, or persisted conversation data.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence

Finding

The third npx elite-longterm-memory example repeats the same supply-chain issue: executing an unpinned package means users may unknowingly run changed code in the future. Since the skill markets itself for persistent memory, backups, and agent context retention, the blast radius is larger than a typical CLI because the tool may handle sensitive prompts, decisions, and project state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README recommends Mem0-based automatic fact extraction and shows sending conversation messages to an external service, but it does not present a clear privacy warning, consent requirement, or data-handling caveat. In a long-term memory skill, conversations can include source code, credentials, internal plans, and personal data, so encouraging automatic external transmission without prominent safeguards materially increases privacy and compliance risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence

Finding

The skill requests access to environment-backed capabilities via metadata requirements (for example OPENAI_API_KEY) but does not declare an explicit tool scope or permissions boundary. That creates ambiguity about what the agent may access and increases the chance of overbroad secret exposure or unintended tool use during memory operations.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The instruction to write before responding establishes session persistence of conversation content as a default operational rule. In this skill's context, where memory is a core feature and multiple storage backends are encouraged, that increases the risk of unnecessary retention and downstream disclosure.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

• ...

text

**Rule:** Write BEFORE responding. Triggered by user input, not agent memory.

### Layer 2: WARM STORE (LanceDB Vectors)
**From: lancedb-memory**

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly says to store important user decisions in Git-Notes silently, without any user-facing notice that the conversation is being persisted. Silent retention of conversational data is a privacy and trust issue, especially when the stored content may later be searched, exported, or synced.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill promotes automatic fact extraction and cloud-backed memory services but does not clearly warn that conversation content may be transmitted to and stored by third parties. In a memory skill, that omission is particularly risky because users may share sensitive preferences, project details, or credentials during normal use.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documentation instructs sending conversation-derived data to Mem0 cloud APIs using persistent user identifiers, which expands data flows beyond the manifest's stated local memory stack. This is dangerous because user content and identifiers may be transmitted to third-party services without clear consent, minimization, or retention controls.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

bash

export SUPERMEMORY_API_KEY="your-key"
# Add to ~/.zshrc for persistence

Agent Instructions

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The agent instructions direct broad persistence of user-provided details and preferences before responding, which encourages indiscriminate retention of natural-language data. Without minimization rules, this can capture sensitive or unnecessary information simply because it was mentioned in conversation.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The WAL protocol mandates logging user-provided preferences, decisions, deadlines, and corrections before every response, creating a default behavior of blanket conversational capture. In context, this is more dangerous because the skill also routes data into multiple stores, increasing duplication and persistence of potentially sensitive information.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The example workflow demonstrates immediate persistence of a user's statement into several memory stores before responding. This normalizes automatic retention and multiplies copies of user-derived data, making later deletion, review, and containment harder.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

md

User: "Let's use Tailwind for this project, not vanilla CSS"

Agent (internal):
1. Write to SESSION-STATE.md: "Decision: Use Tailwind, not vanilla CSS"
2. Store in Git-Notes: decision about CSS framework
3. memory_store: "User prefers Tailwind over vanilla CSS" importance=0.9
4. THEN respond: "Got it — Tailwind it is..."

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The instruction to push git-notes to a remote repository can exfiltrate accumulated memory, decisions, and conversation-derived notes outside the local environment. Because the skill encourages storing user preferences and decisions, syncing notes remotely materially increases the chance of unintended disclosure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The help text instructs users to run the package via npx elite-longterm-memory without pinning a specific version. This causes execution of whatever version is current in the registry at install/run time, which creates a supply-chain risk if a malicious or compromised release is published later. In a developer tool that writes files into the current workspace, that risk is more meaningful because users are being encouraged to execute package code directly.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This second unpinned npx elite-longterm-memory invocation has the same supply-chain issue: it resolves and executes the latest published package version at runtime. If the package namespace, maintainer account, or release pipeline is ever compromised, users following the built-in help text could execute attacker-controlled code in their environment.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 36)May include surrounding context.

json

"typescript"
  ],
  "optionalDependencies": {
    "mem0ai": "^1.0.0"
  },
  "author": "NextFrontierBuilds",
  "license": "MIT",

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:293