T09 · Insecure Skill Coding Practices
Error
- Location
scripts/trucontext-openclaw.sh:49- Finding
Arbitrary Python Code Injection Through Interpolated File-System Paths
- Content
View full analysis
- Remediation
View remediation
Security audit
TruContext OpenClaw
Security checks for vulnerabilities and agentic risk
Overview
This persistent-memory skill is mostly coherent, but its wrapper has concrete security flaws that could execute local code or access the wrong agent memory context.
Review before installing. Use this only if you are comfortable with TruContext storing agent memory across sessions, and avoid running the wrapper from untrusted or oddly named directories. Prefer a pinned, verified install of the TruContext tools, and ask the publisher to fix the path handling, remove the first-agent fallback, and add clearer consent/deletion controls before using it for sensitive projects.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure DependenciesIntroduces malicious components through unsafe dependency sources
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Findings (4)
T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/trucontext-openclaw.sh:56- Finding
Cross-Agent Memory Access Through Prefix Matching and Insecure Fallback
- Content
View full analysis
- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/trucontext-openclaw.sh:158- Finding
JSON Property Injection Through Unescaped Entity Names
- Content
View full analysis
- Remediation
View remediation
T08 · Insecure Dependencies
Warning
- Location
SKILL.md:4- Finding
Unpinned npm Installation and Runtime Package Execution
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (5)
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
md ## What this skill reads - **`~/.trucontext/openclaw-state.json`** — agent config written by `trucontext-openclaw install`. Contains your root node ID, user root node ID, recipe, and workspace path. No secrets. - **TruContext CLI auth** (`~/.trucontext/credentials.json`) — the `trucontext` CLI manages its own auth tokens. This skill calls the CLI; it does not read or store credentials directly. To authenticate, run: `npx trucontext login`. ## Verbs
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 90% confidence
- Finding
This skill is explicitly designed for cross-session persistent memory, including remembering significant details, creating nodes, and recalling prior context. Persistent storage is not inherently malicious, but it does create privacy and retention risk because normal agent interactions may be durably recorded and later resurfaced, especially given the broad triggers and startup recall behavior.
- Content
md --- name: trucontext-openclaw description: "TruContext persistent memory for OpenClaw agents. Use when you need to remember something significant across sessions, recall prior context, query the knowledge graph, check what TC is curious about, or declare entity nodes. Triggers on: 'remember this', 'recall what we know about', 'check TC', 'what has TC flagged', 'create a node for', 'find the node for'." homepage: https://trucontext.ai metadata: {"openclaw": {"emoji": "🧠", "homepage": "https://trucontext.ai", "requires": {"bins": ["trucontext", "python3"]}, "install": [{"id": "npm-trucontext-openclaw", "kind": "node", "package": "trucontext-openclaw", "bins": ["trucontext-openclaw"], "label": "Install trucontext-openclaw (npm) — includes TC CLI setup"}]}} ---
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The trigger phrases are broad and overlap with normal conversation, such as 'remember this' and 'recall what we know about'. In an agent setting, ambiguous activation can cause the skill to run unexpectedly and send sensitive conversational context into persistent storage or external queries without sufficiently intentional user consent.
- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 87% confidence
- Finding
The skill instructs users to run
npx trucontext login, which fetches and executes the latest package version at runtime without pinning. That creates a supply-chain risk: if the upstream package is compromised or a breaking/malicious version is published, authentication-related commands could execute attacker-controlled code in the user's environment.- Content
Rp1
Medium
- Category
- MCP Rug Pull
- Confidence
- 90% confidence
- Finding
The script tells users to run
npx trucontext loginwhen authentication fails, which invokes an unpinned package from the registry at execution time. If the package is malicious, typosquatted, or the upstream account is compromised, this can lead to arbitrary code execution on the user's machine. In this skill's context, that is more dangerous because the script is meant to be used persistently by agents handling memory and context, making it likely to be trusted and run in developer environments.- Content