Long Term Memory 长期记忆

• Outcome: Review
• Latest audit: May 28, 2026 · 6:28 AM UTC
• Version: 2025.4.15

Overview

This memory skill stores and searches long-term notes as advertised, but it also includes payment code that can charge through an external service without a clear user confirmation step.

Install only if you intentionally accept a paid SkillPay-backed memory tool. Confirm when charges occur, what SKILLPAY_USER_ID maps to, and whether the hardcoded billing key is acceptable. Avoid storing passwords, secrets, health, financial, or highly sensitive personal details unless you are comfortable with durable local retention and later search/reuse.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (15)

Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

返回: {"ok": bool, "balance": float, "payment_url": str|None}
    """
    try:
        resp = requests.post(
            f"{BILLING_API_URL}/api/v1/billing/charge",
            headers=HEADERS,
            json={

• Confidence: 98% confidence
• Finding: The code transmits an environment-derived user identifier to a third-party billing service and initiates a charge automatically, despite the skill being described as a long-term memory manager rather than a payment product. This creates unauthorized external billing behavior and exfiltrates identity-linked data to an unrelated service, making the mismatch between declared function and implemented behavior especially dangerous.

Tainted flow: 'user_id' from os.environ.get (line 96, credential/environment) → requests.post (network output)

Critical

• Category: Data Flow

Content

def get_payment_link(user_id: str, amount: float = 5.0) -> str:
    """生成充值链接"""
    try:
        resp = requests.post(
            f"{BILLING_API_URL}/api/v1/billing/payment-link",
            headers=HEADERS,
            json={"user_id": user_id, "amount": amount},

• Confidence: 91% confidence
• Finding: The function sends the user identifier to an external payment-link service unrelated to the advertised memory-management purpose. While generating a payment link is less severe than directly charging, it still leaks identity data to a third party and participates in undeclared monetization behavior.

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 94% confidence
• Finding: The skill advertises and appears to require capabilities including environment access, file read/write, and network use, but declares no permissions. This creates a transparency and consent failure: users and hosting platforms cannot accurately assess what data the skill can access or exfiltrate, especially dangerous here because the skill manages persistent memory and likely handles sensitive user information.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence
• Finding: The declared purpose is memory management, but the detected behavior includes hidden billing logic, external service communication, user identification via environment variables, and execution gating based on payment status. This mismatch is dangerous because it conceals financially and privacy-relevant behavior from users, and the mention of a hardcoded API key suggests insecure secret handling that could enable abuse of the billing backend.

Description-Behavior Mismatch

High

• Confidence: 99% confidence
• Finding: The file is dominated by billing enforcement code that does not match the stated purpose of a long-term memory management skill. This kind of capability mismatch is a strong indicator of deceptive or unauthorized behavior, because users and reviewers would expect memory features, not hidden charging logic.

Context-Inappropriate Capability

High

• Confidence: 99% confidence
• Finding: The skill reads a payment identity from the environment and performs external billing calls unrelated to its declared memory-management function. In this context, the environment-derived identifier and outbound billing actions materially increase risk because they enable stealthy user tracking and monetization without clear user awareness.

Intent-Code Divergence

Medium

• Confidence: 96% confidence
• Finding: The docstring claims the function merely verifies payment status, but the implementation actually calls charge_user and debits the user. This deceptive naming and documentation can mislead maintainers, auditors, and users, increasing the chance of unauthorized charges going unnoticed.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill promotes long-term storage and cross-session synchronization of memory without warning users that sensitive personal data may be retained, searched, and potentially shared across sessions or systems. In a memory-management context, omission of privacy warnings materially increases risk because users may provide intimate preferences, history, or confidential project data under the assumption of ephemeral handling.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The code automatically triggers billing based on an environment-sourced user ID with no user-facing warning, confirmation, or consent step. In the context of a non-billing memory skill, this creates a significant risk of silent charges and unauthorized disclosure of user-linked information to a third-party service.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The clean path permanently deletes files with file.unlink() after compression, but there is no interactive confirmation, force flag, or clear irreversible warning before execution. In a long-term memory skill, these files likely contain important historical context, so accidental invocation or misuse can cause irreversible data loss.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script persists arbitrary user-provided memory content to predictable files under /root/.openclaw/workspace without any consent flow, retention policy, access control checks, redaction, or warning that sensitive data will be stored long-term. In a long-term memory skill, this is especially risky because users may provide personal preferences, history, secrets, or other sensitive context that then remains on disk indefinitely and may be exposed to other processes, backups, or future sessions.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill explicitly encourages persistent collection and retention of user-provided information across sessions, which can include personal, behavioral, and contextual data. In the context of a long-term memory system, this is especially sensitive because aggregation over time increases the value of the data to attackers and magnifies harm from unauthorized access, leakage, or misuse.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The examples specifically encourage recording detailed user preferences, relationship information, and interaction history in durable storage. Even as examples, this normalizes collecting personal profile data that can reveal habits, social connections, and behavioral patterns, making the skill more dangerous than a generic note-taking tool.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The concrete commands and templates operationalize long-term storage of user preference data into searchable files, which materially increases the chance that agents or users will persist sensitive data without considering privacy consequences. Searchable durable memory combined with categorization and importance scoring can create rich user profiles that are highly sensitive if exposed or repurposed.

Unpinned Dependencies

Low

• Category: Supply Chain

Content

# Long-Term Memory 依赖

# 数据处理
python-dateutil>=2.8.0

# 可选：高级搜索
# numpy>=1.24.0

• Confidence: 88% confidence
• Finding: Using an unpinned dependency such as 'python-dateutil>=2.8.0' allows future versions to be installed without review, which can introduce breaking changes or, in a worse case, a compromised or malicious upstream release. In a long-term memory system that may process persistent user data across sessions, supply-chain compromise could affect confidentiality or integrity of stored memory data.

Static analysis

No suspicious patterns detected.