Elite Longterm Memory 1.2.3

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:31 PM UTC
• Version: 1.0.0

Overview

This memory skill is not clearly malicious, but it encourages broad persistent saving and optional cloud syncing of conversation details without enough consent, privacy, or safety controls.

Review this carefully before installing in sensitive workspaces. Use pinned package versions, avoid enabling Mem0/SuperMemory or git-notes remote sync unless you explicitly want conversation-derived data to leave the machine, do not store secrets or personal data in memory files, and treat the LanceDB removal command as destructive.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T08 · Insecure Dependencies

Warning

• Location: package.json:35
• Finding: Unused Optional Dependency Introduces Avoidable Supply-Chain Exposure## Vulnerability Details **File Location**: `package.json:35-37` **Vulnerability Type**: Unnecessary third-party dependency **Risk Level**: Medium **Vulnerable Code**: ```json "optionalDependencies": { "mem0ai": "^1.0.0" }, ``` ### Technical Analysis The package declares `mem0ai` as an optional dependency even though `bin/elite-memory.js`, the package's only executable script, neither imports nor uses it. Package managers ordinarily attempt to resolve and install optional dependencies unless users explicitly disable that behavior. As a result, installing or invoking this local file-initialization utility through npm can introduce `mem0ai` and its transitive dependency tree into the user's environment. The caret version range (`^1.0.0`) may also resolve to future compatible releases that were not reviewed with this package. No evidence indicates that the currently declared dependency is malicious. The issue is the unnecessary expansion of the package's supply-chain attack surface. ### Attack Path 1. A user runs `npx elite-longterm-memory init` or installs the package through npm. 2. npm resolves the package's optional dependencies. 3. npm downloads `mem0ai` and potentially its transitive dependencies, despite the CLI not requiring them. 4. A compromised future compatible release, compromised transitive dependency, or unsafe dependency lifecycle behavior executes or becomes available under the installing user's account. 5. The malicious dependency could act with the filesystem, environment, and network permissions granted to the npm process. ### Impact Assessment Exploitation depends on compromise or malicious behavior in the external dependency chain. If that occurs, code could execute with the privileges of the user running npm. The resulting scope could include access to project files, user-readable configuration and environment variables, and outbound network connectivity. This declaration does not itsel ...[truncated 124 chars]
• Remediation: ## Remediation Suggestions - Remove `mem0ai` from `optionalDependencies`, because the shipped CLI does not require it. - Document Mem0 as a separate, explicitly installed, opt-in integration. - If programmatic integration becomes necessary, isolate it behind a dedicated package or optional feature and load it only after explicit user consent. - Pin an audited version rather than allowing unreviewed compatible releases through a broad range. - Maintain and review a lockfile where applicable, inspect transitive dependencies, and use package integrity and provenance controls. - Disable unnecessary dependency lifecycle scripts in sensitive deployment environments.

other

Warning

• Location: SKILL.md:137
• Finding: Recommended Cloud Integration Can Disclose Sensitive Conversation Content## Vulnerability Details **File Location**: `SKILL.md:137-149` **Additional Location**: `README.md:105-117`, `SKILL.md:334-347` **Vulnerability Type**: External disclosure of conversation data **Risk Level**: Medium **Vulnerable Documentation and Code**: ```bash npm install mem0ai export MEM0_API_KEY="your-key" ``` ```javascript const { MemoryClient } = require('mem0ai'); const client = new MemoryClient({ apiKey: process.env.MEM0_API_KEY }); // Conversations auto-extract facts await client.add(messages, { user_id: "user123" }); // Retrieve relevant memories const memories = await client.search(query, { user_id: "user123" }); ``` ### Technical Analysis The documented integration passes the complete `messages` collection to an external Mem0 client for processing and storage. Agent conversations can contain source code, credentials, API tokens, personal information, business data, or other confidential context. Although the cloud integration is described as optional and requires an API key, the example does not implement data classification, secret redaction, field minimization, per-transmission confirmation, or retention and deletion controls. Users following the example may therefore cross a local-to-cloud trust boundary without understanding which data is transmitted or retained. The executable CLI does not perform this transmission automatically. Exposure occurs only if a user or agent installs, configures, and invokes the documented external integration. ### Attack Path 1. A user follows the recommended Mem0 integration instructions. 2. The user configures `MEM0_API_KEY` and initializes `MemoryClient`. 3. The application collects conversation messages, potentially including sensitive content. 4. The application invokes `client.add(messages, { user_id: "user123" })`. 5. The message contents leave the local environment and are processed or stored by the external provider. 6. Sensitive data may ...[truncated 649 chars]
• Remediation: ## Remediation Suggestions - Clearly identify Mem0 as an external data processor and explain that submitted messages leave the local environment. - Require explicit, informed opt-in before enabling cloud synchronization or extraction. - Display the destination and categories of data to be transmitted before the first upload. - Apply secret detection and redaction to API keys, passwords, tokens, private keys, and other credentials. - Minimize transmitted data by sending only approved facts rather than complete raw conversations. - Provide configurable allowlists and denylists for projects, message types, and sensitive data categories. - Use per-user identifiers that do not expose unnecessary personal information. - Document provider retention, access, encryption, deletion, and account-compromise considerations. - Provide deletion and export procedures and recommend local-only storage for sensitive sessions. - Update the example to obtain affirmative consent and sanitize `messages` before calling `client.add`.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The skill markets itself as a comprehensive durable memory system with WAL, vector search, git-notes, and cloud backup, but the file only provides documentation and setup guidance rather than implementing those controls. This mismatch is dangerous because operators may assume persistence, recall, and privacy safeguards exist when they do not, leading to unsafe reliance and accidental data handling errors.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

memory_recall query="*" limit=50

# Clear all vectors (nuclear option)
rm -rf ~/.openclaw/memory/lancedb/
openclaw gateway restart

# Export Git-Notes

• Confidence: 90% confidence
• Finding: The skill includes a destructive deletion command that recursively removes the LanceDB memory directory. Even though it is intended as maintenance, users may run it without understanding the data loss consequences, and agentic contexts can magnify risk if such commands are executed automatically.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

memory_recall query="*" limit=50

# Clear all vectors (nuclear option)
rm -rf ~/.openclaw/memory/lancedb/
openclaw gateway restart

# Export Git-Notes

• Confidence: 90% confidence
• Finding: The skill includes a destructive deletion command that recursively removes the LanceDB memory directory. Even though it is intended as maintenance, users may run it without understanding the data loss consequences, and agentic contexts can magnify risk if such commands are executed automatically.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The README instructs users to execute the package via `npx elite-longterm-memory` without pinning a specific version. That causes users to fetch and run whatever version is current at execution time, creating a supply-chain risk if a malicious update or account compromise occurs; because this is a memory tool intended to run inside developer workspaces, it may gain access to sensitive code and context.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: This command also uses unpinned `npx` execution, so the user is instructed to run remote package code at the latest published version rather than a reviewed release. In the context of an agent memory system integrated with IDEs and repositories, compromise of the package could expose workspace files, secrets, or persisted conversation data.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 96% confidence
• Finding: The third `npx elite-longterm-memory` example repeats the same supply-chain issue: executing an unpinned package means users may unknowingly run changed code in the future. Since the skill markets itself for persistent memory, backups, and agent context retention, the blast radius is larger than a typical CLI because the tool may handle sensitive prompts, decisions, and project state.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README recommends Mem0-based automatic fact extraction and shows sending conversation messages to an external service, but it does not present a clear privacy warning, consent requirement, or data-handling caveat. In a long-term memory skill, conversations can include source code, credentials, internal plans, and personal data, so encouraging automatic external transmission without prominent safeguards materially increases privacy and compliance risk.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 84% confidence
• Finding: The skill requests access to environment-backed capabilities via metadata requirements (for example OPENAI_API_KEY) but does not declare an explicit tool scope or permissions boundary. That creates ambiguity about what the agent may access and increases the chance of overbroad secret exposure or unintended tool use during memory operations.

Session Persistence

Medium

• Category: Rogue Agent

Content

- [ ] ...
```

**Rule:** Write BEFORE responding. Triggered by user input, not agent memory.

### Layer 2: WARM STORE (LanceDB Vectors)
**From: lancedb-memory**

• Confidence: 88% confidence
• Finding: The instruction to write before responding establishes session persistence of conversation content as a default operational rule. In this skill's context, where memory is a core feature and multiple storage backends are encouraged, that increases the risk of unnecessary retention and downstream disclosure.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The skill explicitly says to store important user decisions in Git-Notes silently, without any user-facing notice that the conversation is being persisted. Silent retention of conversational data is a privacy and trust issue, especially when the stored content may later be searched, exported, or synced.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill promotes automatic fact extraction and cloud-backed memory services but does not clearly warn that conversation content may be transmitted to and stored by third parties. In a memory skill, that omission is particularly risky because users may share sensitive preferences, project details, or credentials during normal use.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The documentation instructs sending conversation-derived data to Mem0 cloud APIs using persistent user identifiers, which expands data flows beyond the manifest's stated local memory stack. This is dangerous because user content and identifiers may be transmitted to third-party services without clear consent, minimization, or retention controls.

Session Persistence

Medium

• Category: Rogue Agent

Content

```bash
export SUPERMEMORY_API_KEY="your-key"
# Add to ~/.zshrc for persistence
```

## Agent Instructions

• Confidence: 90% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The agent instructions direct broad persistence of user-provided details and preferences before responding, which encourages indiscriminate retention of natural-language data. Without minimization rules, this can capture sensitive or unnecessary information simply because it was mentioned in conversation.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The WAL protocol mandates logging user-provided preferences, decisions, deadlines, and corrections before every response, creating a default behavior of blanket conversational capture. In context, this is more dangerous because the skill also routes data into multiple stores, increasing duplication and persistence of potentially sensitive information.

Session Persistence

Medium

• Category: Rogue Agent

Content

User: "Let's use Tailwind for this project, not vanilla CSS"

Agent (internal):
1. Write to SESSION-STATE.md: "Decision: Use Tailwind, not vanilla CSS"
2. Store in Git-Notes: decision about CSS framework
3. memory_store: "User prefers Tailwind over vanilla CSS" importance=0.9
4. THEN respond: "Got it — Tailwind it is..."

• Confidence: 90% confidence
• Finding: The example workflow demonstrates immediate persistence of a user's statement into several memory stores before responding. This normalizes automatic retention and multiplies copies of user-derived data, making later deletion, review, and containment harder.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The instruction to push git-notes to a remote repository can exfiltrate accumulated memory, decisions, and conversation-derived notes outside the local environment. Because the skill encourages storing user preferences and decisions, syncing notes remotely materially increases the chance of unintended disclosure.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: The help text instructs users to run the package via `npx elite-longterm-memory` without pinning a specific version. This causes execution of whatever version is current in the registry at install/run time, which creates a supply-chain risk if a malicious or compromised release is published later. In a developer tool that writes files into the current workspace, that risk is more meaningful because users are being encouraged to execute package code directly.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence
• Finding: This second unpinned `npx elite-longterm-memory` invocation has the same supply-chain issue: it resolves and executes the latest published package version at runtime. If the package namespace, maintainer account, or release pipeline is ever compromised, users following the built-in help text could execute attacker-controlled code in their environment.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

"typescript"
  ],
  "optionalDependencies": {
    "mem0ai": "^1.0.0"
  },
  "author": "NextFrontierBuilds",
  "license": "MIT",

• Confidence: 40% confidence
• Finding: Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:293