Lovefromio Elite Longterm Memory

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:56 AM UTC
• Version: 1.2.5

Overview

This memory skill is mostly purpose-aligned, but it directs agents to silently retain user context and recommends third-party memory upload without enough consent or privacy controls.

Install only if you are comfortable with persistent agent memory. Before using it, disable silent automatic capture unless explicitly wanted, avoid sending full conversations to Mem0 or SuperMemory without consent and redaction, pin package versions, and review/delete memory files regularly.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:246

Finding

Silent Persistence of Untrusted User Content in Long-Term Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:78, SKILL.md:99, and SKILL.md:246-248
Vulnerability Type: Persistent memory poisoning through unvalidated user-controlled content
Risk Level: Medium

Vulnerable Code

markdown

**Rule:** Write BEFORE responding. Triggered by user input, not agent memory.

bash

# Store a decision (SILENT - never announce)
python3 memory.py -p $DIR remember '{"type":"decision","content":"Use React for frontend"}' -t tech -i h

markdown

1. **User gives concrete detail?** → Write to SESSION-STATE.md BEFORE responding
2. **Important decision made?** → Store in Git-Notes (SILENTLY)
3. **Preference expressed?** → `memory_store` with importance=0.9

Technical Analysis

The Skill instructs the Agent to persist concrete user details, decisions, and preferences automatically. Important decisions are explicitly written to Git Notes silently, without notifying the user.

No validation or trust-boundary mechanism distinguishes benign facts from attacker-supplied instructions. The documented process also lacks:

• Explicit user consent before persistence
• Detection of instruction-like or adversarial content
• Provenance and trust labels
• Restrictions on sensitive information
• Expiration or retention limits
• A review step before recalled content affects future sessions

Because the stored content is designed to survive context compaction and session changes, malicious content can have a longer lifetime than ordinary prompt injection. If recalled memory is subsequently treated as trusted context, an attacker can indirectly influence future Agent behavior.

Attack Path

1. An attacker provides a crafted statement represented as a preference, decision, or concrete project detail.
2. Following the Skill instructions, the Agent writes the content to SESSION-STATE.md, Git Notes, or vector memory before responding.
3. The write may occur s ...[truncated 833 chars]

Remediation

View remediation

Remediation Suggestions

• Require explicit user approval before persisting a new fact, preference, or decision.
• Never silently store security-sensitive or behavior-changing content.
• Reject or quarantine content containing instructions, tool requests, credentials, access tokens, or attempts to redefine Agent policy.
• Store provenance, creation time, originating user, trust level, and expiration time with every memory.
• Treat recalled memory as untrusted data rather than authoritative instructions.
• Present persistent changes in a reviewable audit log and support deletion or correction.
• Restrict memory writes to a defined schema and allowlisted categories.
• Separate factual memory from executable instructions or Agent policy.
• Apply retention limits and avoid storing unnecessary personal or confidential information.

other

Warning

• Location: SKILL.md:137

Finding

Unfiltered Conversation Content May Be Sent to an External Memory Service

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:137-146, SKILL.md:334-343, and README.md:105-114
Vulnerability Type: Third-party conversation data disclosure
Risk Level: Medium

Vulnerable Code

bash

npm install mem0ai
export MEM0_API_KEY="your-key"

javascript

const { MemoryClient } = require('mem0ai');
const client = new MemoryClient({ apiKey: process.env.MEM0_API_KEY });

// Conversations auto-extract facts
await client.add(messages, { user_id: "user123" });

// Retrieve relevant memories
const memories = await client.search(query, { user_id: "user123" });

The README contains the same recommended transmission pattern:

javascript

const { MemoryClient } = require('mem0ai');
const client = new MemoryClient({ apiKey: process.env.MEM0_API_KEY });

// Auto-extracts facts from messages
await client.add(messages, { user_id: "user123" });

// Retrieve relevant memories  
const memories = await client.search(query, { user_id: "user123" });

Technical Analysis

The recommended Mem0 integration submits the complete messages object to a third-party API. The documented example does not perform data minimization, secret detection, redaction, field selection, or consent verification before transmission.

Agent conversations can contain source code, authentication material, personal information, internal project details, file contents, and other confidential data. Passing the complete message collection to an external processor expands the data-access boundary beyond the local Agent environment.

The integration is documented as optional and is not invoked by bin/elite-memory.js; therefore, the audit found no covert transmission in the bundled CLI. The risk arises when users implement the recommended integration as shown.

Attack Path

1. A user enables the recommended Mem0 integration and configures MEM0_API_KEY.
2. Sensitive information enters the Agen ...[truncated 810 chars]

Remediation

View remediation

Remediation Suggestions

• Make external transmission explicitly opt-in at both workspace and user levels.
• Clearly identify the destination service and explain what data will be transmitted and retained.
• Send selected, structured facts instead of complete conversation objects.
• Apply secret scanning and redact API keys, passwords, tokens, private keys, personal data, and proprietary content.
• Require confirmation before transmitting content classified as sensitive.
• Define retention, deletion, export, and data-residency controls.
• Use pseudonymous identifiers rather than directly identifying user IDs where possible.
• Document the third party's role, privacy policy, and security assumptions.
• Provide a fully local memory option for confidential environments.

T08 · Insecure Dependencies

Note

• Location: package.json:29

Finding

Optional Dependency Uses an Unlocked Version Range

Content

View full analysis

Vulnerability Details

File Location: package.json:29-31
Vulnerability Type: Unpinned third-party dependency and supply-chain exposure
Risk Level: Low

Vulnerable Code

json

"optionalDependencies": {
  "mem0ai": "^1.0.0"
}

Related installation guidance appears at SKILL.md:137 and README.md:105:

bash

npm install mem0ai

Technical Analysis

The package declares mem0ai using the caret range ^1.0.0. This permits npm to resolve later compatible releases instead of requiring one reviewed artifact. No lockfile or integrity pin is present in the audited project.

Optional dependencies are normally installed by npm unless omitted or unsupported. Consequently, installing this package can add third-party code even though the bundled CLI does not import mem0ai.

The audit did not establish that mem0ai is malicious. The issue is that future installation behavior can change without changes to this repository, increasing exposure to a compromised dependency release, malicious lifecycle script, or upstream account compromise.

Attack Path

1. A user installs elite-longterm-memory with npm's default optional-dependency behavior.
2. npm resolves a version of mem0ai permitted by ^1.0.0.
3. A compromised or otherwise unsafe compatible release is selected.
4. Dependency installation scripts, imported runtime code, or transitive dependencies execute in the user's environment.
5. Such code operates with the permissions of the npm installation or application process.

Impact Assessment

A compromised dependency could potentially read or modify files accessible to the installing user, inspect process environment variables, make network requests, or execute commands through lifecycle behavior. The actual impact would depend on the contents of the resolved dependency and the privileges used during installation.

No malicious dependency behavior was demonstrated in the audi ...[truncated 104 chars]

Remediation

View remediation

Remediation Suggestions

• Remove mem0ai from optionalDependencies if the bundled CLI does not require it.
• If it must remain, pin a reviewed exact version instead of using a caret range.
• Commit a lockfile and verify package integrity in CI.
• Audit the dependency and its transitive dependencies, including lifecycle scripts.
• Use automated dependency monitoring and review updates before release.
• Document installation with --omit=optional for users who do not need external memory integration.
• Run package installation with least privilege and avoid installing as an administrative or root account.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence

Findings (23)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The code only provides basic filesystem operations: creating markdown template files, making a memory directory, creating a daily log, and printing status/help output. It does not implement the major capabilities highlighted in the description such as write-ahead logging, vector search, git-notes storage, or cloud backup. Although it mentions LanceDB in status output and setup text, it does not perform vector indexing/search itself. The declared description substantially overstates the implemented behavior, so this is a clear mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

md

memory_recall query="*" limit=50

# Clear all vectors (nuclear option)
rm -rf ~/.openclaw/memory/lancedb/
openclaw gateway restart

# Export Git-Notes

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

md

memory_recall query="*" limit=50

# Clear all vectors (nuclear option)
rm -rf ~/.openclaw/memory/lancedb/
openclaw gateway restart

# Export Git-Notes

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The README advertises cloud backup and automatic fact extraction from conversations but does not warn that sensitive prompts, memories, or workspace-derived data may be transmitted to external services. Users may reasonably assume memory stays local, causing unintended disclosure of proprietary, personal, or credential-bearing content.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The README instructs users to run the package via npx elite-longterm-memory without pinning a specific version. This makes execution dependent on whatever version is current at install time, so a compromised upstream release or typo-squatted replacement could lead to arbitrary code execution in the user's environment.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

This command again uses unpinned npx execution, which causes users to fetch and run the latest published package rather than a reviewed version. In an agent-memory skill, this is especially risky because the package is expected to touch local workspace files and possibly secrets-containing context stores.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 93% confidence

Finding

The third unpinned npx example repeats the same supply-chain risk: users may execute unreviewed code from the registry at runtime. Because this skill is marketed for persistent memory and agent integration, the blast radius includes filesystem modification, data collection, and persistence-related abuse if the package is ever compromised.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Mem0 integration sample shows client.add(messages, ...) and client.search(...) against an external API without explicitly warning that conversation messages are sent to a third party for processing and storage. In a long-term memory skill, conversations often contain confidential user data, source code, tokens, or internal decisions, so silent external transmission creates a meaningful privacy and compliance risk.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence

Finding

The skill requests environment-based capabilities via metadata (OPENAI_API_KEY) but does not declare an explicit tool/permission scope. That weakens least-privilege guarantees and makes it harder for operators to understand what the skill may access or transmit, especially since later sections discuss external services and automatic memory capture.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 83% confidence

Finding

The instruction to write before responding creates systematic session persistence of user input, increasing retention risk even when data is transient or sensitive. In this skill's context, persistence is the core feature, so automatic pre-response logging materially raises privacy and data-governance concerns.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

• ...

text

**Rule:** Write BEFORE responding. Triggered by user input, not agent memory.

### Layer 2: WARM STORE (LanceDB Vectors)
**From: lancedb-memory**

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The skill explicitly tells the agent to silently persist user decisions and preferences, removing transparency and consent around retention. In a memory skill, this is especially dangerous because users are likely to disclose project, personal, or sensitive context that then becomes durable and potentially searchable across sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

Persisting user preferences and decisions without any privacy notice or retention warning violates transparency and creates hidden surveillance-like behavior. Because the storage is designed to be durable and reused later, the privacy impact compounds over time.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The skill's documented behavior expands from local memory management into third-party cloud backup and automatic fact extraction. That scope expansion increases data-sharing risk because operators may enable external services without realizing user conversation content can leave the local environment.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

Optional cloud backup and auto-extraction features transmit conversation-derived data externally without an explicit warning at the point of use. In context, a memory skill naturally handles long-lived user context, so external sharing raises confidentiality and compliance risks substantially.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The Mem0 integration encourages uploading conversation-derived facts to an external service without clear disclosure, minimization, or justification. That can turn ordinary chats into third-party data exports, including sensitive preferences, internal decisions, and potentially confidential content.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Auto-extraction from full conversations into an external memory service is a strong data over-collection risk. Full-message ingestion can capture secrets, personal data, or confidential business context that users did not intend to preserve or share externally.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Persisting API keys in shell startup files increases the lifetime and accidental exposure surface of secrets, especially on shared systems or where dotfiles are synced or logged. While common operational advice, it is still a risky secret-handling recommendation when safer secret stores may exist.

Content

Scanner excerpt · SKILL.md (reported line 235)May include surrounding context.

bash

export SUPERMEMORY_API_KEY="your-key"
# Add to ~/.zshrc for persistence

Agent Instructions

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The WAL instructions require automatic capture of user-provided details before responding, but users are not warned that their statements will be persistently logged. This creates broad, default retention of potentially sensitive conversation content with no consent boundary.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

These instructions operationalize broad persistence of user details, decisions, deadlines, and corrections before every response. In a conversational system, that can capture sensitive personal data, credentials, internal project information, or regulated content far beyond what is necessary for task completion.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 87% confidence

Finding

The example workflow normalizes storing decisions and preferences across multiple persistent stores before any reply. That reinforces broad retention patterns and makes cross-system propagation of user data seem mandatory, which increases the blast radius of mistaken or sensitive captures.

Content

Scanner excerpt · SKILL.md (reported line 280)May include surrounding context.

md

User: "Let's use Tailwind for this project, not vanilla CSS"

Agent (internal):
1. Write to SESSION-STATE.md: "Decision: Use Tailwind, not vanilla CSS"
2. Store in Git-Notes: decision about CSS framework
3. memory_store: "User prefers Tailwind over vanilla CSS" importance=0.9
4. THEN respond: "Got it — Tailwind it is..."

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

The help text instructs users to run the package via npx elite-longterm-memory without pinning a specific version. That causes execution of whatever version is currently published under that package name, creating a supply-chain risk if a malicious or compromised update is released. In a memory/agent skill context, this is more dangerous because users are being encouraged to execute the tool directly in their environment, often with access to project files and agent context.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 95% confidence

Finding

This second usage example also tells users to execute the package through unpinned npx, which fetches the latest published artifact at runtime. If the package registry entry is hijacked or a bad release is pushed, users may execute attacker-controlled code simply by following the built-in help instructions. Because this skill is marketed for persistent agent memory, likely running in developer environments, the reachable data and filesystem access increase the practical risk.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 95% confidence

Finding

The optional dependency uses a caret range (^1.0.0), which permits automatic installation of future 1.x releases rather than a single vetted version. In a security-sensitive agent memory skill that may process sensitive context and integrate with external services, this increases supply-chain risk if a later compatible release is compromised, introduces malicious postinstall behavior, or changes data-handling behavior unexpectedly.

Content

Scanner excerpt · package.json (reported line 30)May include surrounding context.

json

"fact-extraction"
  ],
  "optionalDependencies": {
    "mem0ai": "^1.0.0"
  },
  "author": "NextFrontierBuilds",
  "license": "MIT",