Session Health Monitor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 10:23 PM UTC
• Version: 1.1.0

Overview

The skill is mostly a local context-health utility, but it asks agents to persist session-derived facts into long-term memory without clear limits and includes unsafe local state handling.

Review this carefully before installing. Use it only if you are comfortable with agents writing summaries of session facts to local long-term memory, and avoid storing secrets, credentials, personal data, or untrusted instructions. Prefer changing the temp-state storage to a private per-user directory before enabling the statusline.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/statusline.sh:42

Finding

Predictable Temporary State File Allows Symlink-Based File Overwrite

Content

View full analysis

/dev/null; then prev_pct=$(jq -r '.last_pct // 0' "$state_file" 2>/dev/null) || prev_pct=0 compactions=$(jq -r '.compactions // 0' "$state_file" 2>/dev/null) || compactions=0 else prev_pct=$(grep -o '"last_pct":[0-9]*' "$state_file" | cut -d: -f2) || prev_pct=0 compactions=$(grep -o '"compactions":[0-9]*' "$state_file" | cut -d: -f2) || compactions=0 fi fi # Detect compaction: usage dropped by more than COMPACTION_DROP points if [[ "$prev_pct" -gt 0 ]] && [[ $((prev_pct - used_pct)) -ge "$COMPACTION_DROP" ]]; then compactions=$((compactions + 1)) fi # Save state cat > "$state_file" </dev/null; then compactions=$(jq -r '.compactions // 0' "$state_file" 2>/dev/null) || compactions=0 # If no stdin data, use stored percentage if [[ -z "$used_pct" ]]; then used_pct=$(jq -r '.last_pct // empty' "$state_file" 2>/dev/null) || true fi else compactions=$(grep -o '"compactions":[0-9]*' "$state_file" | cut -d: -f2) || compactions=0 if [[ -z "$used_pct" ]]; then used_pct=$(grep -o '"last_pct":[0-9]*' "$state_file" | cut -d: -f2) || true fi fi fi ``` ### Technical Analysis The script stores session ...[truncated 2274 chars]

Remediation

View remediation

"$tmp_file" chmod 600 "$tmp_file" mv -f -- "$tmp_file" "$state_file" ``` 5. Validate loaded fields as bounded integers before arithmetic or status decisions. Reject malformed, negative, or unreasonable percentages and compaction counts. ]]>

T02 · Agent Memory Poisoning

Warning

• Location: scripts/snapshot.sh:25

Finding

Session-Derived Content Can Be Persisted into Long-Term Agent Memory Without Trust Validation

Content

View full analysis

> "$daily_file" echo "Saved ${#new_facts[@]} fact(s) to $daily_file" ``` ### Technical Analysis The workflow crosses a trust boundary by extracting material from the current session and storing it in long-term agent memory. Current-session content may include attacker-controlled user messages, retrieved documents, tool output, or other untrusted text. The implementation records selected facts verbatim and does not: - Record the source or trust level of each fact. - Distinguish descriptive data from imperative instructions. - Filter instruction-like content. - Escape or structurally encode Markdown. - Require user confirmation before persistence. - Mark loaded memory as untrusted historical data. If an attacker causes imperative text to be selected as ...[truncated 1862 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (11)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The code does implement part of the declared theme: context-window health monitoring with threshold-based status evaluation. However, the declared description specifically claims additional capabilities—Telegram warnings, pre-compaction snapshots, and memory rotation—that are absent from this code chunk. The script only parses context usage data, optionally consults a temp state file for compaction count and last percentage, emits status output, and sets exit codes. Because the stated purpose includes substantial behaviors not present in the supplied code, the description does not accurately represent what this code chunk actually does.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The declared description presents a broader monitoring and notification tool with Telegram warnings and pre-compaction snapshots. The supplied code only performs one maintenance task: rotating/archive daily memory files older than KEEP_DAYS from the memory directory into an archive folder. It does not monitor context window health, inspect thresholds, send messages, or create snapshots tied to compaction events. While 'memory rotation' is accurately represented, the overall description materially overstates the implemented behavior.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is about context window health monitoring features for OpenClaw agents, specifically mentioning Telegram alerts, pre-compaction snapshots, and memory rotation. The supplied code does something materially different: it is an installer that sets up a Claude statusline script by copying a file into ~/.claude and editing ~/.claude/settings.local.json with jq. This is a local configuration/install action, not the described monitoring and alerting behavior. While a statusline could be related to health display, the stated core capabilities are not present in this chunk, and the code accesses/modifies local Claude config resources that are not disclosed by the description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The implemented code is a simple snapshot logger, not a health monitoring system. It does include a pre-compaction snapshot-style write to a memory file, which partially matches the description, but the major advertised capabilities are absent: there is no monitoring of context window health, no thresholds, no Telegram integration, and no memory rotation behavior. The primary purpose of the code is local persistence of supplied facts with basic deduplication, which is materially narrower and different from the declared multi-feature monitoring/alerting description.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The code does implement part of the declared theme: it monitors context window usage and detects likely compactions based on drops in usage percentage. However, the declared description specifically promises threshold warnings via Telegram, pre-compaction snapshots, and memory rotation. None of those capabilities are present. Instead, the script is a local CLI/statusline utility that reads JSON from stdin, persists minimal per-session state in /tmp, and prints a color-coded status string. This is a materially narrower and different behavior than the declared description, so it should be flagged as a mismatch.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 87% confidence

Finding

The troubleshooting command 'rm /tmp/session-health-*.json' performs wildcard deletion in a shared temporary directory. Even though constrained by a prefix, using rm on /tmp patterns can delete unintended files matching that glob, and in some environments an agent following documentation literally could remove another user's or process's files without confirmation.

Content

Scanner excerpt · SKILL.md (reported line 168)May include surrounding context.

Reset compaction state

bash

rm /tmp/session-health-*.json

Agent not appending footer

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The snapshot protocol instructs the agent to preserve key facts, decisions, blockers, unfinished work, and even user preferences into daily memory files before compaction. Persisting model context to local files can unintentionally store sensitive data, credentials, internal paths, proprietary information, or personal preferences beyond the original session boundary, increasing exposure and retention risk.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The trigger condition 'when the agent detects it has accumulated significant context' is overly broad and subjective, which can cause excessive or inappropriate snapshotting of session state. In a memory-preservation skill, vague triggers increase the chance that sensitive information, user preferences, or transient secrets get written to disk more often than intended.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 163)May include surrounding context.

macOS

brew install jq

Linux

sudo apt-get install jq

text

### Reset compaction state

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · scripts/setup-statusline.sh (reported line 17)May include surrounding context.

sh

if ! command -v jq &>/dev/null; then
    echo "Error: jq is required but not installed."
    echo "  macOS: brew install jq"
    echo "  Linux: sudo apt-get install jq"
    exit 1
fi

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The script persists per-session state in a predictable file under /tmp using a session_id derived from input without sanitization or secure file-creation semantics. On multi-user systems, this can enable symlink or file clobbering attacks, state spoofing, or cross-session interference if an attacker can pre-create or manipulate the target path, especially because the script later reads and overwrites that file.

Content

Scanner excerpt · scripts/statusline.sh (reported line 45)May include surrounding context.

sh

session_id="${session_id:-unknown}"
state_file="/tmp/session-health-${session_id}.json"

# Load previous state
prev_pct=0
compactions=0
if [[ -f "$state_file" ]]; then

Static analysis

No suspicious patterns detected.