YiHui CONTEXT MODE

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

This skill is purpose-aligned but should be reviewed because it installs an unpinned MCP server that can run commands, read or index local content, and fetch web data.

Install only if you trust the npm package source and are comfortable granting this MCP server command execution, web fetching, and local indexing authority. Prefer a pinned, reviewed package version, run it with limited filesystem access, and avoid indexing private repositories or sensitive files until storage location and cleanup behavior are clear.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:67

Finding

Unpinned npm Package Downloaded and Executed Automatically

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 67–70
Vulnerability Type: Unpinned third-party dependency execution
Risk Level: Medium

bash

openclaw mcp set context-mode '{"command":"npx","args":["-y","context-mode"]}'
openclaw gateway restart

Technical Analysis

The installation instructions configure OpenClaw to execute context-mode through npx without specifying an exact package version. The -y option suppresses the normal confirmation prompt. No lockfile, package integrity hash, vendored implementation, or other provenance control is present in the audited project.

As a result, the package executed by users may differ from the version that existed when this Skill was reviewed. A compromised package release, npm maintainer account, transitive dependency, or package-distribution channel could introduce arbitrary code without requiring changes to SKILL.md.

The advertised MCP server processes shell output, file content, and fetched web material. Although the audited file contains no evidence that it exfiltrates such information, a compromised future package could misuse this access. The risk arises from unsafe dependency retrieval rather than confirmed malicious behavior in the reviewed Skill.

Attack Path

1. An attacker compromises the context-mode npm package, a maintainer account, or a dependency included by a future release.
2. The attacker publishes a malicious version under the same package name.
3. A user follows the documented configuration command, which does not constrain package resolution to an audited version.
4. When OpenClaw starts the configured MCP server, npx -y context-mode retrieves and executes the package without an interactive confirmation.
5. Malicious package code runs with the privileges of the OpenClaw process and may access resources available to that user and process.

Impact Assessment

Successful exploitation could permit arbitrary code ...[truncated 580 chars]

Remediation

View remediation

Remediation Suggestions

1. Pin context-mode to a specific, audited version rather than resolving the latest available release.
2. Verify package provenance and integrity through trusted registry metadata, cryptographic integrity values, signatures, or an equivalent verification mechanism.
3. Maintain lockfile or integrity metadata for the package and its transitive dependencies where the deployment model permits it.
4. Review the selected package version and dependency tree before recommending installation.
5. Avoid -y where practical so unexpected package acquisition remains visible to the user.
6. Run the MCP server under a dedicated, least-privileged account or sandbox with narrowly scoped filesystem and network access.
7. Restrict access to sensitive repositories, credentials, environment variables, and unrelated user files.
8. Document what information is indexed, where the SQLite database is stored, how long indexed data persists, and whether any data leaves the local environment.
9. Establish a controlled update process in which new package versions are reviewed and explicitly approved before deployment.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp2

High

• Category: MCP Tool Poisoning
• Confidence: 85% confidence

Finding

Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Several trigger phrases are broad everyday requests such as '帮我研究', '帮我搜索', and '检查更新', which can cause the skill to activate in many unrelated conversations. Because this skill can route execution, file reads, and web fetches through MCP tools, over-broad activation increases the chance of unintended tool use, context manipulation, or unnecessary exposure of local/project data.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The trigger section lists activation phrases in Chinese while the rest of the document is in English, which creates an implicit language constraint for invocation. There is no accompanying statement that users may invoke the skill in other languages or choose their preferred locale.

Content

No source excerpt is available for this finding.