T02 · Agent Memory Poisoning
Warning
- Location
SKILL.md:246- Finding
Unvalidated and Silent Persistence of User-Controlled Content
- Content
View full analysis
- Remediation
View remediation
Security audit
Elite Longterm Memory
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is not clearly malicious, but it needs Review because it encourages broad persistent capture of user context and recommends third-party memory services without clear consent or redaction controls.
Install only if you are comfortable with an agent keeping durable memory about conversations and project decisions. Keep cloud and Mem0 integrations disabled unless you have reviewed what will be uploaded, avoid storing secrets or personal data, prefer pinned package versions, and review memory files and vectors regularly before syncing or sharing them.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (3)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:133- Finding
Potential Disclosure of Conversation Data to Third-Party Memory Services
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Note
- Location
package.json:35- Finding
Unused Optional Dependency Expands the Package Supply-Chain Surface
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- Rogue AgentSelf-Modification, Session Persistence
Findings (24)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The declared description substantially overstates the functionality. The code only creates and inspects local markdown files and a memory directory, plus checks for the existence of an optional LanceDB directory under the user's home folder. There is no actual memory retrieval system, no write-ahead log protocol, no vector indexing/search operations, no git-notes interaction, and no cloud synchronization logic. The primary behavior is a lightweight project scaffolding/status CLI for markdown memory files, which is materially narrower than the declared purpose.
- Content
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The command deletes the LanceDB memory directory recursively, which is intentionally destructive and could cause data loss if run carelessly or copied into the wrong environment. In a skill aimed at agent users, including a 'nuclear option' without safeguards increases the chance of accidental misuse.
- Content
md memory_recall query="*" limit=50 # Clear all vectors (nuclear option) rm -rf ~/.openclaw/memory/lancedb/ openclaw gateway restart # Export Git-Notes
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 90% confidence
- Finding
The command deletes the LanceDB memory directory recursively, which is intentionally destructive and could cause data loss if run carelessly or copied into the wrong environment. In a skill aimed at agent users, including a 'nuclear option' without safeguards increases the chance of accidental misuse.
- Content
md memory_recall query="*" limit=50 # Clear all vectors (nuclear option) rm -rf ~/.openclaw/memory/lancedb/ openclaw gateway restart # Export Git-Notes
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The README instructs users to run the package via
npx elite-longterm-memorywithout pinning a specific version. This causes execution of whatever version is current on the registry at runtime, creating a supply-chain risk where a compromised, typosquatted, or newly published malicious version could be executed immediately in the user's environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
This invocation also uses unpinned
npx, which fetches and executes the latest package version. In an agent-tooling context, this is especially risky because users may copy-paste commands with elevated trust, and a registry compromise or malicious update could lead to arbitrary code execution.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 95% confidence
- Finding
The third unpinned
npxexample repeats the same supply-chain exposure by encouraging direct execution of the latest registry artifact. Because this skill targets AI-agent users and development workspaces, compromise could expose source code, secrets, or developer machines.- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The WAL guidance instructs agents to persist user decisions before responding, which operationalizes unconditional logging of user inputs into memory. In a memory skill, this context makes the issue more dangerous because the feature is specifically designed to preserve conversation state across sessions, so accidental storage of credentials, regulated data, or sensitive instructions becomes more likely and durable.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The README promotes automatic fact extraction and optional cloud sync but does not clearly warn that conversation contents may be transmitted to third-party services or stored persistently. Users may enable these features without understanding that prompts, secrets, personal data, or proprietary project information could leave the local environment.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The documentation encourages automatic extraction and retention of conversation-derived facts into persistent memory systems. In practice, this can normalize indiscriminate collection of user content, increasing the chance that sensitive data is retained longer than necessary and later surfaced to other sessions, tools, or services.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 93% confidence
- Finding
The skill declares environment requirements, including OPENAI_API_KEY, but does not define an explicit tool scope or permissions boundary. In an agent ecosystem, that omission can lead to over-broad access and makes it harder for operators to understand what external resources or secrets the skill may use.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 86% confidence
- Finding
The directive to 'write before responding' creates a persistence-first behavioral rule for user input. In a memory skill, this increases retention risk because it encourages immediate durable logging before relevance, sensitivity, or consent can be assessed.
- Content
- ...
text **Rule:** Write BEFORE responding. Triggered by user input, not agent memory. ### Layer 2: WARM STORE (LanceDB Vectors) **From: lancedb-memory**
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The cloud backup and Mem0 sections instruct operators to send memory and conversation-derived data to external services without a clear privacy warning or consent checkpoint. This is dangerous because agents may persist sensitive user content, project details, or identifiers to third parties without informed user approval.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The skill broadens its behavior from local memory management to external conversation upload via Mem0, which changes the trust boundary and data exposure model. Users expecting a local-only memory tool may unintentionally send conversation content and identifiers to a third-party service.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Automatic fact extraction tied to a user_id promotes continuous collection and persistence of conversation-derived data, potentially including personal, proprietary, or sensitive content. Because the feature is framed as efficiency optimization, operators may enable it without appreciating the privacy and retention risks.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
bash export SUPERMEMORY_API_KEY="your-key" # Add to ~/.zshrc for persistenceAgent Instructions
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The instructions encourage silently storing user preferences, decisions, and other details into local files and git notes without informing the user. Persistent retention of conversation content can expose sensitive information later through local access, backups, repository sync, or other tooling.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
These instructions direct the agent to persist user-provided details before responding, creating default capture behavior for conversational content. In a memory skill, that context makes the issue more dangerous because broad retention is presented as normal operation rather than a carefully bounded exception.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The WAL protocol tells the agent to log user-supplied information before replying, which encourages blanket data capture as a default workflow. This increases the chance that sensitive prompts, corrections, deadlines, and preferences are retained even when they do not need durable storage.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
The example workflow normalizes multi-layer persistence of user statements across session files, git notes, and vector memory before any response. That pattern expands data retention and replication, increasing exposure if local files, backups, or sync mechanisms are later accessed or leaked.
- Content
md User: "Let's use Tailwind for this project, not vanilla CSS" Agent (internal): 1. Write to SESSION-STATE.md: "Decision: Use Tailwind, not vanilla CSS" 2. Store in Git-Notes: decision about CSS framework 3. memory_store: "User prefers Tailwind over vanilla CSS" importance=0.9 4. THEN respond: "Got it — Tailwind it is..."
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
The help text instructs users to run
npx elite-longterm-memorywithout pinning a version.npxwill fetch the latest package at execution time, so a compromised publisher account, malicious new release, or dependency hijack could cause users to execute unreviewed code. In a developer tool that is explicitly meant to be installed and run locally, this raises meaningful supply-chain risk.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 97% confidence
- Finding
This second usage example also invokes
npx elite-longterm-memorywithout a version pin, creating the same time-of-use supply-chain exposure. Because the skill markets itself as an agent memory system for coding assistants, users may execute these commands with broad filesystem access in active development repositories, increasing the blast radius of a malicious package update.- Content
Description-Behavior Mismatch
Low
- Category
- Not specified by scanner
- Confidence
- 83% confidence
- Finding
The manifest advertises a memory system built around WAL protocol, vector search, git-notes, and cloud backup, but the skill documentation also instructs users to add a separate Mem0-based auto-extraction pipeline that automatically sends conversation content for fact extraction. That capability changes the behavior from storage/search of user-managed memories to active extraction and external processing of conversation data, which is not reflected in the manifest description.
- Content
Vague Triggers
Low
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This manifest file is in scope for vague-trigger review, and the description says 'Never lose context again' while advertising a broad 'Ultimate AI agent memory system' across multiple assistants. That language is expansive and non-specific about when the skill should be invoked or what boundaries apply, which can contribute to unintended activation in agent ecosystems that rely on package metadata or descriptions.
- Content
Unpinned Dependencies
Low
- Category
- Supply Chain
- Confidence
- 86% confidence
- Finding
The optional dependency
mem0aiis specified with a caret range (^1.0.0), allowing newer minor/patch releases to be installed without review. In an AI memory package that may handle sensitive context and persistence, this increases supply-chain risk: a compromised or breaking upstream release could introduce malicious behavior or unsafe data handling during install or runtime.- Content
json "typescript" ], "optionalDependencies": { "mem0ai": "^1.0.0" }, "author": "NextFrontierBuilds", "license": "MIT",
Static analysis
Detected: suspicious.destructive_delete_command
Documentation contains a destructive delete command without an explicit confirmation gate.
Warn
- Code
- suspicious.destructive_delete_command
- Location
- SKILL.md:293