T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:193- Finding
Unfiltered and Silent Persistence of User-Controlled Conversation Data
- Content
View full analysis
- Remediation
View remediation
Security audit
Elite Longterm Memory
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is not clearly malicious, but it should be reviewed carefully because it encourages silent, durable storage of conversation details and optional cloud memory use without enough privacy controls.
Install only if you intentionally want persistent agent memory and are comfortable reviewing what gets stored. Treat cloud memory and Mem0/SuperMemory setup as opt-in, avoid storing secrets or private project data, pin package versions instead of using unpinned npx commands, and inspect or back up memory stores before deleting or syncing them.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
other
Warning
- Location
SKILL.md:127- Finding
Unbounded Transmission of Conversation Content to a Third-Party Memory Service
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
package.json:37- Finding
Unused Automatically Resolved Optional Dependency Expands Supply-Chain Exposure
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (18)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The skill markets itself as a complete memory system with WAL, vector search, git-notes, cloud backup, and cross-assistant support, but the file mainly contains prose and setup guidance rather than enforced implementations. This mismatch can mislead users and operators into assuming safety, durability, or functionality that is not actually guaranteed, increasing the chance of unsafe reliance and accidental data handling.
- Content
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
Automatic fact extraction plus cloud backup broadens capture from selected notes to potentially large portions of conversations and sends them to external systems. In context, this memory skill is specifically designed for persistent cross-session retention, which makes over-collection and downstream leakage more likely and more damaging.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The skill includes a destructive shell command to recursively delete the local memory database directory. Even though it is labeled a 'nuclear option,' embedding such commands in skill guidance can lead agents or users to execute irreversible deletion without safeguards, especially in automated contexts.
- Content
md memory_recall query="*" limit=50 # Clear all vectors (nuclear option) rm -rf ~/.openclaw/memory/lancedb/ openclaw gateway restart # Export Git-Notes
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The skill includes a destructive shell command to recursively delete the local memory database directory. Even though it is labeled a 'nuclear option,' embedding such commands in skill guidance can lead agents or users to execute irreversible deletion without safeguards, especially in automated contexts.
- Content
md memory_recall query="*" limit=50 # Clear all vectors (nuclear option) rm -rf ~/.openclaw/memory/lancedb/ openclaw gateway restart # Export Git-Notes
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The README instructs users to run
npx elite-longterm-memorywithout pinning a specific package version. This causes execution of whatever version is current in the registry at runtime, creating a supply-chain risk where a newly published malicious or compromised release could be executed immediately on user machines. In the context of an agent memory tool that is meant to be installed and trusted inside developer workspaces, that risk is more significant because the tool may access project files and sensitive context.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This command again uses
npx elite-longterm-memorywithout a pinned version, so users will execute the latest registry version rather than a reviewed release. If the package is hijacked, typo-squatted, or a maintainer account is compromised, the README guidance directly facilitates arbitrary code execution. Because this skill markets itself to AI-agent workflows and workspace integration, users may run it in privileged development environments, increasing exposure.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The unpinned
npx elite-longterm-memory todaycommand has the same supply-chain exposure as the other examples: it executes the latest package version at invocation time. Documentation that normalizes unpinned remote execution is dangerous because it encourages users to trust dynamic code delivery without version control. In a memory-management skill, compromise could expose stored conversation context, repository contents, or credentials present in the environment.- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README promotes automatic fact extraction from conversations and optional cloud sync but does not warn users that prompts, conversation history, and potentially sensitive workspace-derived data may be transmitted to third-party services. This is a genuine privacy and security issue because users may enable these features without understanding the data handling implications, leading to leakage of secrets, proprietary code context, or personal information. The skill context makes this more dangerous because it is specifically designed to persist long-term agent memory, increasing both the amount and sensitivity of retained data.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 86% confidence
- Finding
The skill requests environment-based capability via metadata (
OPENAI_API_KEY) and describes commands and integrations, but it does not declare an explicit tool/permission scope. That creates an authorization ambiguity where a host agent may expose more capability than users expect, especially for memory capture and external-service access.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 88% confidence
- Finding
The 'write before responding' rule causes the agent to persist user-triggered content immediately, creating session persistence of potentially sensitive details by default. In a memory skill, this is more dangerous because the instruction is central to behavior and encourages broad, automatic retention rather than selective storage.
- Content
- ...
text **Rule:** Write BEFORE responding. Triggered by user input, not agent memory. ### Layer 2: WARM STORE (LanceDB Vectors) **From: lancedb-memory**
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill instructs the agent to store user decisions silently in Git-Notes without an explicit consent or privacy notice. Silent persistence of conversational content is dangerous because users may not realize their statements are being retained across sessions and repositories.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill promotes automatic fact extraction and cloud-backed memory using external services but does not provide a clear warning that conversation content may be transmitted off-device. This creates a meaningful privacy risk because sensitive user data, project details, or secrets could be captured and sent to third parties automatically.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash export SUPERMEMORY_API_KEY="your-key" # Add to ~/.zshrc for persistenceAgent Instructions
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The WAL instructions direct the agent to persist user-provided details before responding and retain them across sessions. That pattern increases the chance that personal data, business-sensitive context, or mistaken entries are written to storage reflexively without review or minimization.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The example workflow explicitly stores a user decision in multiple persistence layers before replying. This normalizes hidden, redundant retention of conversation content, increasing privacy exposure and the blast radius if any memory layer is later accessed, synced, or leaked.
- Content
md User: "Let's use Tailwind for this project, not vanilla CSS" Agent (internal): 1. Write to SESSION-STATE.md: "Decision: Use Tailwind, not vanilla CSS" 2. Store in Git-Notes: decision about CSS framework 3. memory_store: "User prefers Tailwind over vanilla CSS" importance=0.9 4. THEN respond: "Got it — Tailwind it is..."
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The help text instructs users to run
npx elite-longterm-memorywithout pinning a specific package version. Becausenpxfetches the latest published package by default, a compromised maintainer account, typosquatted package update, or malicious new release could cause users to execute unexpected code on their machine.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This line repeats an unpinned
npx elite-longterm-memoryinvocation in user-facing usage instructions. In the context of an agent memory skill, users are likely to copy-paste these commands directly, which increases the practical risk of remote code execution if the package supply chain is ever compromised.- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 84% confidence
- Finding
The optional dependency
mem0aiis version-ranged with a caret (^1.0.0), allowing newer minor/patch releases to be installed without explicit review. While this is common in npm packages, it creates supply-chain risk if a compromised or breaking upstream release is published, especially for a skill centered on persistent memory and agent context handling.- Content
json "typescript" ], "optionalDependencies": { "mem0ai": "^1.0.0" }, "author": "NextFrontierBuilds", "license": "MIT",
Static analysis
Detected: suspicious.destructive_delete_command
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- SKILL.md:293