ClawHub
Back to skill

Security audit

Context Guardian Pro

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed context-pressure monitor that may write summaries to OpenClaw memory and emit alerts, with no artifact-backed evidence of hidden exfiltration, destructive behavior, or privilege escalation.

Install only if you want an automatic context monitor that can append summaries to OpenClaw memory. Review or disable any taskflow/cron setup you add, and treat future QQ-channel configuration as an external notification path that should avoid sensitive conversation content.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The skill explicitly states it will automatically append conversation summaries to long-term memory files, but the documentation does not warn users that potentially sensitive conversational content may be persisted beyond the active session. In a periodically triggered background skill, this increases the risk of silent retention of secrets, personal data, or confidential business context without informed user consent.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill documentation says it will proactively send alerts through a QQ channel, but it does not warn users that conversation-derived operational metadata or reminders may be transmitted to an external messaging channel. Because the skill runs automatically via taskflow or cron, this creates a risk of unnoticed outbound notifications, privacy leakage, or disclosure to unintended recipients if the QQ destination is misconfigured or shared.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The manifest description is entirely in Chinese and describes the skill's behavior in a way that implies a fixed language/locale experience, with no indication that users can opt into another language. The policy requires flagging language or locale constraints when they are imposed without user choice or clear justification.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

Multiple docstrings and comments are written only in Chinese, including operational descriptions such as reading session status, persisting summaries, and sending alerts. This imposes a locale/language constraint in the skill's natural-language surface without any user opt-in or documented justification, matching the language-policy violation criteria.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/guardian.py (reported line 12)May include surrounding context.

python
"""
    try:
        # 运行 session_status 命令
        result = subprocess.run(['openclaw', 'session_status'], capture_output=True, text=True)
        output = result.stdout
        print(f"DEBUG: session_status output:\n{output}")

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

The function claims to only simulate persistence, but it actually appends data to a file under the user's home directory. In an agent skill context, hidden or misleading persistence is security-relevant because it can store potentially sensitive session-derived content without clear user consent or accurate documentation, creating confidentiality and compliance risks.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/taskflow_executor.py (reported line 16)May include surrounding context.

python
# In a real implementation, this would involve complex logic monitoring session files.
    # For now, we trigger the python script we just wrote.
    run_script = flow.add_task("run_guardian_script", 
                               action=lambda: subprocess.run([sys.executable, "~/.openclaw/workspace/skills/context-guardian/scripts/guardian.py"], capture_output=True, text=True))

    # Task 2: Verification/Logging
    verify_task = flow.add_task("log_task_result",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The code launches an external Python script via subprocess, which is a safety-relevant operation for code files. Although there is a generic print at L24, it does not disclose that an external script from a filesystem path will be executed, and there is no confirmation prompt or explicit warning comment/docstring describing the execution risk.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
81% confidence
Finding

All user-facing documentation in this skill file is written in Chinese, and there is no indication that language selection is configurable or intentionally limited to a Chinese-only audience. This can violate language/locale policy when the skill imposes a specific language without user opt-in.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
93% confidence
Finding

The docstring at L51-L53 says the function simulates sending a QQ alert. The implementation merely prints a formatted message and returns True, so it does not actually send anything; this contradicts the apparent operational meaning of the function name and caller expectations.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low
Category
Not specified by scanner
Confidence
82% confidence
Finding

The function documentation says it 'orchestrates the Context Guardian process' and 'wraps the Python script execution into a structured task,' implying execution behavior. In practice, the function just creates a flow object and adds a subprocess-based task definition; the actual external script invocation is deferred, so the documentation overstates what this code does.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.