ClawHub
Back to skill

Security audit

qui-elite-longterm-memory

Security checks for vulnerabilities and agentic risk

Overview

This skill is a memory helper, but it encourages silent long-term retention and recommended third-party processing of conversation content without enough user control or privacy scoping.

Review this before installing if you handle secrets, private code, personal data, or regulated information. Use local-only memory where possible, avoid enabling SkillBoss auto-extraction for sensitive conversations, inspect memories regularly, and do not let the agent silently persist facts or decisions you have not approved.

A.I.G

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
SKILL.md:155
Finding

Unredacted Conversation Data May Be Transmitted to a Third-Party API

Content
View full analysis
Remediation
View remediation

T02 · Agent Memory Poisoning

Warning
Location
SKILL.md:273
Finding

Silent and Overbroad Persistence of User-Controlled Conversation Content

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Findings (22)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill markets itself as a complete, 'bulletproof' memory system with WAL, vector search, git-notes, and cloud backup, but the file mostly contains guidance and example snippets rather than implemented controls. This mismatch can mislead users and agents into assuming durability, privacy, or recall guarantees that do not actually exist, which can cause unsafe handling of sensitive context.

Content

No source excerpt is available for this finding.

Missing User Warnings

High
Category
Not specified by scanner
Confidence
97% confidence
Finding

The cloud backup and auto-extraction sections describe sending memory and conversation-derived content to SkillBoss API without a prominent warning that user data may leave the local environment. External transmission of conversation content materially raises privacy and compliance risk, especially if sensitive project or personal information is included.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Although the deletion path is scoped, the skill recommends a raw recursive delete command as part of routine maintenance guidance. In agent-assisted or copy-paste scenarios, destructive shell commands can be executed without adequate verification, causing data loss in the local memory store.

Content

Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.

md
memory_recall query="*" limit=50

# Clear all vectors (nuclear option)
rm -rf ~/.openclaw/memory/lancedb/
openclaw gateway restart

# Export Git-Notes

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
90% confidence
Finding

Although the deletion path is scoped, the skill recommends a raw recursive delete command as part of routine maintenance guidance. In agent-assisted or copy-paste scenarios, destructive shell commands can be executed without adequate verification, causing data loss in the local memory store.

Content

Scanner excerpt · SKILL.md (reported line 326)May include surrounding context.

md
memory_recall query="*" limit=50

# Clear all vectors (nuclear option)
rm -rf ~/.openclaw/memory/lancedb/
openclaw gateway restart

# Export Git-Notes

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The README instructs users to run the package via npx elite-longterm-memory without pinning a specific version. That causes execution of whatever version is current at install time, which creates a supply-chain risk if a malicious or compromised release is published; in an agent-memory skill, that code may gain access to workspace contents and sensitive conversation state.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

This command again recommends unpinned npx execution for the status action. Repeated exposure increases the chance users or agents will execute an unexpected package version, and because this skill manages memory/context, a malicious update could inspect or exfiltrate stored logs and agent state.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
96% confidence
Finding

The today example also uses unpinned npx, preserving the same remote-code-execution/supply-chain exposure. In the context of a memory tool that creates and reads persistent files, compromise could alter records, poison memory, or steal sensitive project data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The README recommends automatic extraction of facts, preferences, and decisions from conversations using an external API, but does not present a clear privacy warning, consent requirement, or data-classification guidance. Since this skill is explicitly designed to retain long-term agent memory, the extracted content may include sensitive user data, secrets, internal decisions, or proprietary context, making the omission materially risky.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
89% confidence
Finding

The file references and demonstrates sending data to https://api.heybossai.com/v1, which is an external transmission path. While external APIs are not inherently malicious, here the integration is used for memory extraction from conversations, so it can transmit sensitive context outside the local environment; the skill context makes this more dangerous because memory systems aggregate exactly the data users are least likely to want leaked.

Content

Scanner excerpt · README.md (reported line 106)May include surrounding context.

javascript
const API_KEY = process.env.SKILLBOSS_API_KEY
const API_BASE = 'https://api.heybossai.com/v1'

async function pilot(body) {
  const r = await fetch(`${API_BASE}/pilot`, {

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
84% confidence
Finding

The skill requests access to an environment variable (SKILLBOSS_API_KEY) and documents networked capabilities, but it does not declare a clear tool scope or permission boundary for those capabilities. In an agent-skill ecosystem, missing explicit permissions increases the chance that secrets or network actions are used without adequate review or user understanding.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
92% confidence
Finding

The WAL rule directs the agent to write user-provided information to persistent state before responding. In a memory skill, this means data capture occurs automatically and immediately, reducing the opportunity for user awareness, consent, or filtering of sensitive content.

Content

Scanner excerpt · SKILL.md (reported line 78)May include surrounding context.

  • ...
text

**Rule:** Write BEFORE responding. Triggered by user input, not agent memory.

### Layer 2: WARM STORE (LanceDB Vectors)
**From: lancedb-memory**

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly instructs the agent to store decisions 'SILENTLY' and to persist user preferences or facts without a user-facing notice. Silent long-term retention of conversational content creates a privacy risk because users may not realize their statements are being recorded and reused later.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
91% confidence
Finding

This section includes code that transmits data to https://api.heybossai.com/v1, creating an external data flow from the agent environment to a third-party service. In the context of a memory skill, the transmitted payload may contain persistent context or user-derived information, making the privacy impact more significant.

Content

Scanner excerpt · SKILL.md (reported line 131)May include surrounding context.

javascript
const API_KEY = process.env.SKILLBOSS_API_KEY
const API_BASE = 'https://api.heybossai.com/v1'

async function pilot(body) {
  const r = await fetch(`${API_BASE}/pilot`, {

Ssd 3

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill recommends automatic fact extraction from full conversations and storage for later reuse, which encourages broad collection and retention of user data. Because extraction is applied to conversation history, it can capture sensitive details users did not intend to persist.

Content

No source excerpt is available for this finding.

External Transmission

Medium
Category
Data Exfiltration
Confidence
94% confidence
Finding

This example sends conversation messages to an external chat endpoint for automatic fact extraction. Because the payload can include full conversation history, the risk is higher than ordinary API use: sensitive prompts, secrets, and personal data may be exfiltrated to a third party without adequate notice.

Content

Scanner excerpt · SKILL.md (reported line 156)May include surrounding context.

javascript
const API_KEY = process.env.SKILLBOSS_API_KEY
const API_BASE = 'https://api.heybossai.com/v1'

async function pilot(body) {
  const r = await fetch(`${API_BASE}/pilot`, {

Session Persistence

Medium
Category
Rogue Agent
Confidence
90% confidence
Finding

The instruction to add SKILLBOSS_API_KEY to ~/.zshrc persists a credential in a long-lived shell startup file. While common operationally, it increases exposure if the workstation is shared, backups are compromised, or other processes can read shell configuration.

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

bash
export SKILLBOSS_API_KEY="your-key"
# Add to ~/.zshrc for persistence

Agent Instructions

Ssd 3

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The operational instructions make long-term persistence of user-provided details the default behavior during normal conversation flow. Default capture of preferences, corrections, deadlines, and decisions increases the chance of collecting sensitive data beyond what is necessary for the immediate task.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
94% confidence
Finding

The example workflow shows a concrete pattern of persisting user preferences and project decisions across multiple stores before replying. This demonstrates and reinforces default durable retention behavior, which can lead to overcollection and long-lived storage of potentially sensitive user context.

Content

Scanner excerpt · SKILL.md (reported line 313)May include surrounding context.

md
User: "Let's use Tailwind for this project, not vanilla CSS"

Agent (internal):
1. Write to SESSION-STATE.md: "Decision: Use Tailwind, not vanilla CSS"
2. Store in Git-Notes: decision about CSS framework
3. memory_store: "User prefers Tailwind over vanilla CSS" importance=0.9
4. THEN respond: "Got it — Tailwind it is..."

External Transmission

Medium
Category
Data Exfiltration
Confidence
90% confidence
Finding

This repeated API example again normalizes outbound transmission to the SkillBoss service as part of recommended setup. Repetition in the skill increases the likelihood that integrators will enable external data transfer without separately evaluating privacy and compliance implications.

Content

Scanner excerpt · SKILL.md (reported line 368)May include surrounding context.

javascript
const API_KEY = process.env.SKILLBOSS_API_KEY
const API_BASE = 'https://api.heybossai.com/v1'

async function pilot(body) {
  const r = await fetch(`${API_BASE}/pilot`, {

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

The help text instructs users to run the package via npx elite-longterm-memory without pinning a specific version. That causes execution of whatever version is currently published under that package name, creating a supply-chain risk if a malicious or compromised release is published later. In a memory/agent skill, this is more dangerous because users are encouraged to run it in active project directories where the tool can read and write local files.

Content

No source excerpt is available for this finding.

Rp1

Medium
Category
MCP Rug Pull
Confidence
94% confidence
Finding

This second usage example also tells users to execute the package through unpinned npx, which implicitly trusts the latest registry state at runtime. An attacker who hijacks the package, maintainer account, or publishing pipeline could deliver arbitrary code to users who follow the help instructions. The skill context increases risk because the tool is designed to manage long-term memory files and may be run in repositories containing sensitive context.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low
Category
Supply Chain
Confidence
40% confidence
Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 36)May include surrounding context.

json
"typescript"
  ],
  "optionalDependencies": {
    "mem0ai": "^1.0.0"
  },
  "author": "NextFrontierBuilds",
  "license": "MIT",

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn
Code
suspicious.destructive_delete_command
Location
SKILL.md:326