Remember All Prompts Daily

• Outcome: Review
• Latest audit: Jul 10, 2026 · 2:25 AM UTC
• Version: 1.0.1

Overview

This skill is not malicious, but it deliberately saves and reuses full conversation history in local persistent files with limited privacy controls.

Install only if you intentionally want full local conversation memory. Avoid using it for sensitive chats unless you are comfortable with transcripts being stored under ~/.clawd/memory, and review or delete those files regularly. Do not run the setup, heartbeat, or cron steps unless you want ongoing automatic archiving behavior.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (18)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill declares behavior that reads and writes files and invokes shell commands, but does not declare those permissions explicitly. This creates a transparency and trust problem: users or tooling cannot accurately assess what capabilities the skill needs before it operates, increasing the chance of unexpected filesystem modification or command execution.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 93% confidence
• Finding: The documented purpose says the skill preserves continuity by archiving prompts and restoring summaries, but the described behavior also modifies HEARTBEAT state, offers cron integration, and appears to persist full conversation history rather than just summaries. That mismatch is dangerous because users may consent to a narrow memory feature while the skill performs broader persistence and automation actions they did not expect.

Intent-Code Divergence

Medium

• Confidence: 94% confidence
• Finding: The script claims that token usage will be checked automatically and that prompts will auto-export and later be available for ingestion, but the code only edits a local HEARTBEAT file and prints optional cron instructions. This is dangerous because users may rely on automation that does not actually exist, leading to unexpected retention behavior assumptions, missed safeguards, or accidental exposure if they later enable adjacent scripts without informed consent.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The skill's core design is to archive all prompts and responses, but the user-facing text does not provide a prominent warning that potentially sensitive conversation content will be retained on disk. This can expose secrets, personal data, credentials, or proprietary content to later disclosure through local access, backups, logs, or accidental sharing.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The automatic trigger workflow exports session history when token usage crosses a threshold, but does not prominently warn the user that this writes conversation data to persistent storage. Automatic disk writes of full session contents are especially risky because they can happen without a deliberate decision at the moment sensitive data is present.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The script persists full session history, including user and assistant prompts, into a local archive under the user's home directory without consent, notice, filtering, or access controls. This creates a durable store of potentially sensitive data such as secrets, personal information, internal prompts, or credentials that may otherwise have remained transient in session memory.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script modifies the user's ~/.clawd/HEARTBEAT.md file without explicit warning or confirmation before performing the write. Silent modification of user state is risky in an agent skill because it can alter future agent behavior and introduce persistence mechanisms or data-handling instructions the user did not knowingly approve.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The skill instructs persistent collection and later re-ingestion of all user prompts and responses, effectively creating a long-lived transcript store of potentially sensitive interactions. Re-ingesting archived content also increases the blast radius of any prompt-injection, secrets exposure, or privacy-sensitive material by carrying it across sessions.

Ssd 3

High

• Confidence: 97% confidence
• Finding: Formatting and appending all prompts and responses with timestamps into a persistent archive creates a detailed behavioral and content record that may include credentials, personal data, internal documents, or harmful prompt content. Timestamps and metadata further increase sensitivity by making correlation and reconstruction of user activity easier.

Ssd 3

High

• Confidence: 96% confidence
• Finding: The documented file structure explicitly calls for storing complete session contents in a daily memory file, which is a clear persistent data-retention risk. Because the archive is organized chronologically, it can accumulate a rich history of sensitive interactions over time and become a high-value target for unauthorized access.

Ssd 3

High

• Confidence: 97% confidence
• Finding: Using session history APIs to fetch all messages and append them with metadata to persistent storage expands the risk from temporary conversational context to durable local data collection. This is dangerous both for privacy and for security, since archived messages may include secrets or adversarial content that later gets reused out of context.

Ssd 3

Medium

• Confidence: 84% confidence
• Finding: The statement that the skill 'respects privacy' while storing the user's actual prompts and responses is misleading and may cause users to underestimate the retention risk. This increases the chance that sensitive data will be exposed because users are not given an accurate model of what is being stored.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: The stated purpose of the script is to export all prompts from the current session to a daily archive, which is a blanket-retention design for conversational data. In the context of an agent skill, this is dangerous because prompts commonly contain confidential user inputs, system instructions, API keys, or regulated data, and automatic archival broadens the exposure window and attack surface.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The archive path and session export logic reflect an intentional 'remember all prompts' behavior that appends complete conversation history into persistent memory files over time. This is risky because it normalizes indiscriminate accumulation of user input and model output, making later compromise, accidental disclosure, or unintended reuse of sensitive context more likely.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The script automatically converts archived prior conversation text into 'previous session context' and presents it for reuse in a new session without any filtering, consent check, or sensitivity review. Because prompts may contain secrets, personal data, or adversarial instructions, this creates a real cross-session data leakage and prompt-injection persistence risk.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The file-level description normalizes extracting, archiving, and later re-ingesting all prompts across sessions, creating a built-in retention path for potentially sensitive user data. In the context of a memory/continuity skill, this is especially risky because prompts often contain secrets, personal data, credentials, or proprietary context that may be resurfaced beyond the user's original expectation.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The heartbeat entry instructs the agent to export the current session when usage is high and ingest prior context in fresh sessions, directly establishing a persistence and resurfacing workflow for user-provided content. Because this behavior is embedded into a recurring operational file, it increases the likelihood of broad, repeated retention of sensitive data without granular review.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The setup completion messages tell the user that prompts will auto-export to memory and that prior context will be available for future ingestion, reinforcing a persistent data-retention model. In this skill's context, that materially increases risk because it encourages storage and later reuse of entire conversation content, which may contain sensitive or security-relevant information.

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.