clear-context

• Outcome: Review
• Latest audit: Aug 26, 2026 · 1:26 PM UTC
• Version: 1.9.19

Overview

This skill is not overtly malicious, but it can carry unattended or dangerous execution authority into fresh agents with limited user checkpoints.

Install only if you intentionally want automated context handoffs and are comfortable with continuation agents preserving unattended or dangerous execution mode. Avoid using it during production changes, credential handling, destructive operations, account or financial actions, or any workflow where each step should receive fresh human approval.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (8)

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The skill explicitly tells continuation agents to inherit dangerous or unattended execution mode and to proceed without asking for confirmation. That expands the skill from context-preservation into autonomous authority propagation, which can cause a fresh subagent to perform risky actions with reduced human oversight.

Context-Inappropriate Capability

Medium

• Confidence: 95% confidence
• Finding: The spawned subagent is instructed to continue all remaining tasks without user prompts whenever auto_continue or dangerous/unattended mode is set. This creates an autonomous execution path where the new agent may carry out multiple actions beyond the original handoff purpose, increasing the chance of unsafe or unintended operations.

Context-Inappropriate Capability

Medium

• Confidence: 92% confidence
• Finding: The batch-processing section broadens the skill into unattended multi-task execution, directing the agent to process an entire queue without stopping. That materially increases operational scope and blast radius compared with a simple context-clear handoff, especially if one queued task is harmful or mis-specified.

Context-Inappropriate Capability

Medium

• Confidence: 91% confidence
• Finding: The module explicitly tells continuation agents to inspect environment variables and session context to determine whether they should run in unattended or dangerous mode. Persisting and propagating execution authority across handoffs broadens the skill from simple state transfer into privilege/consent carry-forward, which can cause a fresh agent to continue high-risk actions without re-validating user intent or current safety constraints.

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The documentation normalizes a "dangerous" execution mode that continues automatically and skips permissions, then instructs agents to capture and propagate that mode through checkpoints. In the context of a handoff skill, this is unsafe because it transfers high-risk operating behavior to a new agent instance, undermining approval boundaries and increasing the chance of destructive actions without user review.

Vague Triggers

Medium

• Confidence: 78% confidence
• Finding: The trigger condition is broad—'context pressure is critical and work must continue uninterrupted'—without strong boundaries on what kinds of work are safe to continue automatically. Ambiguous activation criteria can cause the skill to be invoked during sensitive operations where autonomous handoff is unsafe.

Missing User Warnings

Medium

• Confidence: 88% confidence
• Finding: The skill instructs agents to write session state to disk and continue in dangerous or unattended mode, but it does not require a user-facing warning about persistent storage or autonomous continuation. That can expose sensitive context in checkpoint files and normalize risky behavior without informed operator awareness.

Autonomous Decision Making

Medium

• Category: Excessive Agency

Content

**Execution mode inheritance**: Always inherit and propagate the execution
mode from the session state. If the parent was in dangerous/unattended mode,
you are also in that mode. Do not ask the user for confirmation.

**Task deduplication**: Do not create duplicate tasks. The parent has already
populated the task list. Use TaskUpdate on existing task IDs only.

• Confidence: 94% confidence
• Finding: The instruction 'Do not ask the user for confirmation' removes an important safety control exactly when execution mode may already be dangerous or unattended. In this context, that is a genuine autonomy risk because it suppresses human review while propagating prior authority to a fresh agent.

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.