ClawHub
Back to skill

Security audit

mem0-skill

Security checks across malware telemetry and agentic risk

Overview

This memory skill does what it claims, but it stores sensitive memories and credentials with several under-disclosed persistence and safety risks.

Install only if you are comfortable with the agent sending personal statements to your configured mem0 server, storing the API key in a local .env file, writing setup metadata into project rules, and keeping local logs that may contain memory contents. Review or patch the setup, logging, consent, and delete-all behavior before using it for sensitive information.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (12)

Context-Inappropriate Capability

Medium
Confidence
96% confidence
Finding
The skill instructs the agent to persist mem0 configuration details such as user ID and server address into local rule/project files for future sessions. That expands the data footprint beyond the stated memory-CRUD purpose, creates unnecessary local persistence of potentially sensitive metadata, and can leak configuration into repos, logs, or future agent context.

Intent-Code Divergence

Medium
Confidence
91% confidence
Finding
The document first forbids writing user information to local Markdown files, then later requires recording configuration-related user information locally. This contradiction can cause the agent to bypass its own privacy guardrails and normalize local storage of user-associated data despite earlier prohibitions.

Vague Triggers

Medium
Confidence
90% confidence
Finding
The trigger conditions for saving are overly broad, covering many ordinary personal statements and updates without requiring explicit user consent to store them remotely. In a memory skill, this increases the chance of silently capturing sensitive personal data that the user may have shared only for the current conversation.

Vague Triggers

Medium
Confidence
92% confidence
Finding
The manifest description mandates invocation on broad everyday phrases like name, age, likes, and memory-related questions. That scope makes unintended activation more likely and can cause unnecessary transmission and storage of personal information to the remote memory service.

Missing User Warnings

High
Confidence
97% confidence
Finding
The skill directs the agent to collect base URL, user ID, and especially an API key, then execute setup commands, but it does not require a clear warning about the security and privacy implications of sharing those secrets. This can lead users to disclose credentials into conversational channels or tool contexts without understanding the exposure risk.

Missing User Warnings

High
Confidence
98% confidence
Finding
The skill is designed to store personal information on a self-hosted remote memory service, yet it omits a clear privacy notice explaining that user data will be transmitted off-session and retained remotely. In this context, the omission is significant because the skill is triggered by common personal disclosures and handles potentially sensitive profile data.

Missing User Warnings

Medium
Confidence
88% confidence
Finding
The manifest exposes both single-item and bulk deletion capabilities, including a `delete_all` function labeled only as '谨慎使用' without any stronger user-facing confirmation semantics, scoping guarantees, or recovery expectations. In a long-term memory skill, destructive operations can permanently erase sensitive user data or conversation history if invoked accidentally, ambiguously, or through prompt/agent misuse.

Missing User Warnings

Medium
Confidence
97% confidence
Finding
The save path logs the full user-provided memory message length contextually and, more importantly, sendRequest logs POST/PUT request bodies, which include memory contents written to local disk in logs/ltm-handler.log. Because this skill handles long-term personal memories, those logs can contain sensitive personal data and create an unintended local data exposure surface.

Missing User Warnings

High
Confidence
95% confidence
Finding
The deleteAll function directly issues a DELETE /memories request for the configured user without any confirmation, safeguard, or dry-run step. In a memory-management skill, this can irreversibly erase a user's stored memories if invoked accidentally, by prompt misuse, or by unsafe agent orchestration.

Missing User Warnings

Medium
Confidence
96% confidence
Finding
The script requires the API key to be passed as a command-line argument, which commonly exposes secrets through shell history, process listings, CI logs, and audit tooling. Because this skill manages long-term memory service credentials, accidental disclosure of the key could let another local user or logging system access or manipulate stored memories.

Ssd 3

Medium
Confidence
95% confidence
Finding
Persisting user-provided configuration details locally for future sessions creates unnecessary durable storage outside the dedicated memory system. Even if limited to user ID and server address, those details can reveal service usage, tenant identity, or infrastructure information and may later be combined with other data for account targeting or privacy leakage.

Credential Access

High
Category
Privilege Escalation
Content
}

function saveToEnvFile(config) {
    const envPath = path.join(__dirname, '..', '.env');

    const content = `# mem0 记忆服务配置
# 生成时间: ${new Date().toISOString()}
Confidence
93% confidence
Finding
.env'

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

No suspicious patterns detected.