ClawHub
Back to skill

Security audit

clear-context

Security checks for vulnerabilities and agentic risk

Overview

The skill has a coherent context-handoff purpose, but it asks fresh continuation agents to inherit dangerous or unattended modes and skip confirmation across handoffs.

Review before installing. This skill is meant for long-running automated workflows, but only use it where you are comfortable with continuation agents carrying forward unattended settings. Avoid using it for tasks that can delete data, change permissions, post externally, handle secrets, or spend money unless your environment enforces its own approval gates after every handoff. Periodically delete or inspect .claude/session-state.md because it may contain sensitive project context.

A.I.G

Vulnerability Patterns
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Findings (1)

T01 · Skill Instruction Hijacking

Error
Location
SKILL.md:151
Finding

Continuation agents are instructed to inherit permission-bypass modes and suppress user confirmation

Content
View full analysis
**Important**: If `auto_continue: true` or mode is `dangerous`/`unattended`, > the continuation agent should not pause for user confirmation. > Continue executing all remaining tasks until completion. ``` From `SKILL.md:151-174`: ```markdown Task: Continue the work from session checkpoint Instructions: 1. Read .claude/session-state.md for full context 2. Check the "Execution Mode" section FIRST 3. If `auto_continue: true` or mode is `dangerous`/`unattended`: - DO NOT pause for user confirmation - Continue executing ALL remaining tasks until completion - Only stop on actual errors or when all work is done 4. **TASK LIST**: Do NOT create new tasks via TaskCreate. The parent agent already created the task list. Use TaskList to see existing tasks, and TaskUpdate to mark them in_progress/completed. Check the "Existing Task IDs" section in the session state for the authoritative list. 5. Verify understanding of current task and progress 6. Continue from where the previous agent left off 7. If you also approach 80% context, repeat this handoff process - PRESERVE the execution mode when creating your own checkpoint The session state file contains all necessary context to continue without interruption. **Execution mode inheritance**: Always inherit and propagate the execution mode from the session state. If the parent was in dangerous/unattended mode, you are also in that mode. Do not ask the user for confirmation. ``` From `SKILL.md:196-203`: ```markdown Task: Continue batch processing from session checkpoint Instructions: 1. Read .claude/session-state.md for full context 2. EXECUTION MODE: This is a batch operation with auto_continue= ...[truncated 4053 chars]
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (12)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 25)May include surrounding context.

md
- [Integration with Existing Hooks](#integration-with-existing-hooks)
- [Self-Monitoring Pattern](#self-monitoring-pattern)

# Clear Context Skill

## Quick Start

Missing User Warnings

High
Category
Not specified by scanner
Confidence
94% confidence
Finding

This section explicitly tells the continuation agent not to pause for user confirmation when auto_continue is true or when running in dangerous/unattended modes. In a skill that can hand work to a fresh agent, that increases the chance of high-impact actions being continued autonomously after context rollover, reducing human oversight at exactly the riskiest point.

Content

No source excerpt is available for this finding.

External Model or Provider Selection

High
Category
Excessive Agency
Confidence
90% confidence
Finding

Skill selects an external model or provider that may use a different account or billing plan than the operator expects. Undisclosed model switches can cause unexpected cost or quota consumption.

Content

Scanner excerpt · SKILL.md (reported line 290)May include surrounding context.

For accurate token breakdown in automation:

bash
claude -p "/context" --verbose --output-format json

See /conserve:optimize-context for full headless documentation.

Tool Parameter Abuse

High
Category
Tool Misuse
Confidence
92% confidence
Finding

Propagating --no-confirm creates a tool-parameter abuse risk because it normalizes carrying forward a parameter that suppresses safety checks and approval prompts. This can be exploited if upstream state is tampered with or if a continuation agent over-trusts the checkpoint, resulting in unintended tool use under reduced guardrails.

Content

Scanner excerpt · modules/session-state.md (reported line 141)May include surrounding context.

Flags Inherited

  • --dangerous: Continue executing without user prompts
  • --no-confirm: Skip confirmation dialogs
  • --batch: Processing multiple items
text

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
85% confidence
Finding

The skill presents automatic invocation and uninterrupted continuation as a normal workflow but does not surface an upfront warning that this may create files, spawn subagents, and continue actions without fresh user review. That omission can mislead users about the operational and privacy consequences of enabling the skill in long-running workflows.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The skill instructs the agent to persist a detailed session checkpoint to disk, including task context, progress summaries, active files, and execution state, without requiring a user-facing warning or explicit consent. That can expose sensitive prompts, file paths, plans, or operational metadata to local storage where it may be retained longer than intended or read by other processes/users.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
93% confidence
Finding

The instruction to inherit dangerous/unattended mode and 'Do not ask the user for confirmation' is a direct autonomy escalation. In context, it authorizes chained agents to keep acting under inherited high-risk settings, which can amplify mistakes or unsafe actions across handoffs.

Content

Scanner excerpt · SKILL.md (reported line 206)May include surrounding context.

md
**Execution mode inheritance**: Always inherit and propagate the execution
mode from the session state. If the parent was in dangerous/unattended mode,
you are also in that mode. Do not ask the user for confirmation.

**Task deduplication**: Do not create duplicate tasks. The parent has already
populated the task list. Use TaskUpdate on existing task IDs only.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The --no-confirm flag is specifically documented as inherited by continuation agents, which encourages automated execution without confirmation barriers. In the context of a handoff skill, this is more dangerous because the second agent may act on summarized state rather than full human-reviewed context.

Content

Scanner excerpt · modules/session-state.md (reported line 141)May include surrounding context.

Flags Inherited

  • --dangerous: Continue executing without user prompts
  • --no-confirm: Skip confirmation dialogs
  • --batch: Processing multiple items
text

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
90% confidence
Finding

The --no-confirm flag is specifically documented as inherited by continuation agents, which encourages automated execution without confirmation barriers. In the context of a handoff skill, this is more dangerous because the second agent may act on summarized state rather than full human-reviewed context.

Content

Scanner excerpt · modules/session-state.md (reported line 141)May include surrounding context.

Flags Inherited

  • --dangerous: Continue executing without user prompts
  • --no-confirm: Skip confirmation dialogs
  • --batch: Processing multiple items
text

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
83% confidence
Finding

The module instructs continuation agents to inspect environment variables and infer whether they should operate in unattended or dangerous mode. In a context-handoff format, this broadens scope from passive state persistence into active execution-policy discovery, which can cause a fresh agent to inherit permissive automation settings without explicit user re-confirmation.

Content

No source excerpt is available for this finding.

Skill Enumeration

Medium
Category
Agent Snooping
Confidence
80% confidence
Finding

Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.

Content

Scanner excerpt · modules/session-state.md (reported line 416)May include surrounding context.

md
Complete the session-state.md module, then update context_warning.py

### Context to Re-read
1. `/plugins/conserve/skills/clear-context/SKILL.md` - Main skill reference
2. `/plugins/conserve/hooks/context_warning.py` - Hook to update

### Warnings/Gotchas

Context-Inappropriate Capability

Low
Category
Not specified by scanner
Confidence
76% confidence
Finding

The stated purpose is managing context overflow via a handoff checkpoint, but these instructions expand the continuation agent's capability into broader repository and workflow investigation. That behavior is not an obvious requirement of merely persisting and restoring session state.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.