Back to skill

Security audit

claw-compactor

Security checks for vulnerabilities and agentic risk

Overview

This is a real token-compression skill, but it needs review because it can read global session transcripts, rewrite many workspace files, and install automatic future runs without tight safeguards.

Install only after reviewing the write scope. Start with `benchmark` or `--dry-run` in a version-controlled or disposable workspace, avoid `install`, heartbeat, and cron automation unless you explicitly want recurring mutations, and assume generated observations/codebooks may contain sensitive transcript details that should not be committed or shared without review.

Vulnerability Patterns
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Findings (4)

T06 · System Persistence

Error
Location
scripts/mem_compress.py:460
Finding

Heartbeat Installation Creates Persistent Automatic Execution Instructions

Content
View full analysis
int: """Install heartbeat integration into the workspace HEARTBEAT.md.""" script_path = Path(__file__).resolve() heartbeat_path = workspace / "HEARTBEAT.md" # Build the heartbeat entry with absolute paths entry = f""" ## Memory Compression (auto — claw-compactor) - Run `python3 {script_path} {workspace} benchmark --json` - If savings >5%: auto-run `python3 {script_path} {workspace} full` - If unprocessed session transcripts exist: run observe - Record results to `memory/heartbeat-state.json` """ # Check if already installed if heartbeat_path.exists(): existing = heartbeat_path.read_text(encoding="utf-8") if "claw-compactor" in existing: print("✅ Already installed in HEARTBEAT.md") return 0 # Append to existing with open(heartbeat_path, "a", encoding="utf-8") as f: f.write(entry) else: # Create new HEARTBEAT.md with open(heartbeat_path, "w", encoding="utf-8") as f: f.write("# HEARTBEAT.md\n" + entry) print(f"✅ Installed claw-compactor heartbeat into {heartbeat_path}") print(f" Script: {script_path}") print(f" Workspace: {workspace}") return 0 ``` ### Technical Analysis The `install` command modifies the workspace's persistent `HEARTBEAT.md` instructions. The inserted content directs an Agent to execute the benchmark automatically and to invoke the mutating `full` pipeline when reported savings exceed five percent. This behavior survives the original process and can affect later Agent sessions. It therefore functions as a persistence mechanism rather than merely performing compression during the user-requested invocation. The command is present in the C ...[truncated 1524 chars]
Remediation
View remediation

T05 · Unauthorized Access and Privilege Escalation

Error
Location
scripts/mem_compress.py:171
Finding

Workspace Command Reads All User-Level OpenClaw Session Transcripts

Content
View full analysis
int: """Scan session transcripts and generate observations.""" from observation_compressor import parse_session_jsonl, extract_tool_interactions, rule_extract_observations, format_observations_md sessions_dir = os.path.expanduser("~/.openclaw/sessions") if not os.path.isdir(sessions_dir): print(f"Sessions directory not found: {sessions_dir}", file=sys.stderr) return 1 # Load tracker mem_dir = workspace / "memory" mem_dir.mkdir(exist_ok=True) tracker_path = mem_dir / ".observed-sessions.json" tracker: Dict[str, str] = {} if tracker_path.exists(): try: tracker = json.loads(tracker_path.read_text(encoding="utf-8")) except (json.JSONDecodeError, OSError): tracker = {} # Find session files session_files = sorted(Path(sessions_dir).glob("*.jsonl")) since = getattr(args, 'since', None) new_count = 0 obs_dir = mem_dir / "observations" obs_dir.mkdir(exist_ok=True) for sf in session_files: if sf.name in tracker: continue # Apply --since filter if since: try: # Try to extract date from filename fname = sf.stem if fname < since: continue except Exception: pass try: messages = parse_session_jsonl(sf) interactions = extract_tool_interactions(messages) if not interactions: tracker[sf.name] = datetime.now().isoformat() continue observations = rule_extract_observations(interactions) if observations: md = format_observations_md(ob ...[truncated 2770 chars]
Remediation
View remediation

T02 · Agent Memory Poisoning

Error
Location
scripts/observation_compressor.py:186
Finding

Untrusted Transcript Content Is Persisted as Agent-Readable Memory

Content
View full analysis
List[Dict[str, Any]]: """Extract observations using rule-based heuristics (no LLM needed). Groups interactions by tool and extracts key patterns. """ if not interactions: return [] observations: List[Dict[str, Any]] = [] for interaction in interactions: tool = interaction["tool_name"] output = interaction.get("output_summary", "") or interaction.get("result", "") or "" assistant = interaction.get("assistant_text", "") # Classify obs_type = "discovery" if "error" in output.lower() or "fail" in output.lower(): obs_type = "bugfix" elif tool in ("write", "edit"): obs_type = "feature" elif tool in ("exec",) and ("deploy" in output.lower() or "docker" in output.lower()): obs_type = "deployment" elif tool in ("exec",) and any(k in output.lower() for k in ("config", "setup", "install")): obs_type = "config" title = assistant[:80] if assistant else f"{tool} operation" facts = [f"Tool: {tool}"] if output: # Extract key facts from output output_lines = output.split('\n') for line in output_lines[:5]: line = line.strip() if line and len(line) > 5: facts.append(line[:100]) observations.append({ "type": obs_type, "title": title, "facts": facts, "narrative": assistant[:200] if assistant else f"Ran {tool}", }) return observations ``` ```python def format_observations_md(observa ...[truncated 3248 chars]
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Error
Location
scripts/compress_memory.py:109
Finding

Full Compression Recursively Overwrites All Markdown Files Without Recovery Controls

Content
View full analysis
List[Path]: """Collect markdown files from *target* (file or directory). If *older_than* is set, only include files older than N days. """ path = Path(target) if not path.exists(): raise FileNotFoundError_(f"Path not found: {target}") if path.is_file(): if older_than is not None and _file_age_days(path) < older_than: return [] return [path] # Directory: collect all .md files recursively files = sorted(path.rglob("*.md")) if older_than is not None: files = [f for f in files if _file_age_days(f) >= older_than] return files ``` ```python def compress_file( path: Path, dry_run: bool = False, output: Optional[str] = None, no_llm: bool = False, ) -> Dict[str, Any]: """Compress a single file using rule-based compression.""" path = Path(path) original = path.read_text(encoding="utf-8") original_tokens = estimate_tokens(original) compressed = rule_compress(original) compressed_tokens = estimate_tokens(compressed) reduction_pct = ((original_tokens - compressed_tokens) / original_tokens * 100) if original_tokens else 0.0 result: Dict[str, Any] = { "file": str(path), "original_tokens": original_tokens, "rule_compressed_tokens": compressed_tokens, "rule_reduction_pct": round(reduction_pct, 2), "dry_run": dry_run, } if not no_llm and compressed.strip(): result["llm_prompt"] = generate_llm_prompt(compressed) if not dry_run: target = Path(output) if output else path target.write_text(compressed, encoding="utf-8") re ...[truncated 2457 chars]
Remediation
View remediation
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (58)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
82% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
93% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
97% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
92% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
98% confidence
Finding

Unlike the other TP4 items, this one highlights materially expanded operational scope beyond the declared purpose, including automation changes and access to external session transcript locations. When a skill framed as 'compression' also performs persistence-oriented or broader filesystem inspection tasks, users may authorize it without appreciating the privacy and integrity implications.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The README presents full as a simple one-command operation immediately after a non-destructive benchmark example, but does not clearly warn that it will modify workspace files and create persistent artifacts such as codebooks, observations, and summaries. In an agent skill context, operators may treat README commands as safe defaults, increasing the chance of unintended writes, data loss from lossy compression stages, or silent alteration of memory/state files.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
93% confidence
Finding

The skill advertises commands that read and write workspace files, invoke Python scripts, and includes a git clone step, but the manifest declares no permissions or allowed-tools scope. In an agent skill ecosystem, missing tool-scope declarations weaken user visibility and policy enforcement, increasing the chance of overbroad filesystem, shell, or network access being granted implicitly.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The quick-start prominently recommends a full command that appears to modify the user's workspace, but there is no adjacent warning that files will be rewritten, nor advice to back up data or use --dry-run first. In a skill intended for agents, understated destructive behavior can lead to unintended integrity loss across memory files and derived artifacts.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The documentation advises unattended weekly/cron execution of a command that can rewrite workspace content, yet gives no warning about automated modifications, failure modes, or backup requirements. Automated destructive tasks are riskier because they can silently propagate bad transforms, overwrite user data, or act on an unexpectedly broad path over time.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The document presents a safety property that 'every write operation is opt-in,' but elsewhere documents an automatic heartbeat path that runs observation processing and generates output for new transcripts without an explicit user-triggered opt-in. This mismatch can cause operators or downstream agents to trust the tool as non-destructive when it may write files or metadata automatically, increasing the risk of unintended persistence, workspace modification, or processing of sensitive transcript data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The documentation explicitly shows secrets and workspace-derived identifiers being extracted into a persisted codebook file, including values resembling tokens, usernames, IP prefixes, and SSH key filenames. In a compression skill context, this increases the risk of sensitive data retention, broader exposure surface, and accidental disclosure through stored metadata, backups, logs, or subsequent prompt/context reuse.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The session observation compression flow processes raw transcripts, tool output, command results, and API responses, all of which commonly contain credentials, personal data, internal topology, or proprietary content. Because the skill is specifically designed to condense and preserve salient facts from that material, it can unintentionally retain and propagate sensitive information into long-lived summaries without any warning, filtering, or minimization guidance.

Content

No source excerpt is available for this finding.

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn
Code
suspicious.prompt_injection_instructions
Location
references/compression-techniques.md:210