other
Warning
- Location
install.sh:20- Finding
Undisclosed Installation Telemetry
- Content
View full analysis
- Remediation
View remediation
Security audit
Contextbroker
Security checks for vulnerabilities and agentic risk
Overview
This skill has a legitimate context-memory purpose, but its installer silently changes the user's shell setup and sends an undisclosed install ping to an external service.
Review this skill before installing. Its core memory features may be useful, but they can move sensitive context across sessions and services, and the installer modifies ~/.zshrc and contacts Signalloom during installation without clear consent. Install only if you trust the publisher, are comfortable with the external service handling context, and are prepared to inspect or remove the installer telemetry and PATH change.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
install.sh:17- Finding
Unnecessary Persistent PATH Modification
- Content
View full analysis
/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> "${HOME}/.zshrc" ``` ### Technical Analysis The installer modifies the user's persistent zsh startup configuration by prepending the user-writable `~/.local/bin` directory to `PATH`. However, the reviewed installer does not place a `contextbroker` executable or any other executable in that directory, making the modification unnecessary for the package behavior shown. Placing a user-writable directory before the existing `PATH` increases command-precedence risk. If a malicious or compromised process operating as the same user can create an executable in `~/.local/bin` with the name of a command subsequently invoked by the user, that executable may be selected before the intended system binary. The duplicate-detection check is also imprecise because it only searches for the literal substring `~/.local/bin`. It can treat commented or unrelated text as an existing configuration and does not safely manage a clearly delimited installer-owned configuration block. ### Attack Path 1. The user executes `install.sh`. 2. The installer appends a persistent `PATH` export to `~/.zshrc`. 3. A future zsh session loads the modified configuration and places `~/.local/bin` before the prior search path. 4. An attacker or compromised process already able to write files as that user places a malicious executable in `~/.local/bin` using the name of a command the user is likely to invoke. 5. When the user invokes that command without an absolute path, the shell may execute the malicious file first. This is not an independent privilege-escalation primitive: exploitation requires an attacker or process that can already write to the affected user's files. Successful exploitation would execu ...[truncated 564 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (10)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
A memory/context skill whose observed behavior includes shell profile modification, outbound telemetry, and bootstrap installation is performing actions outside its stated purpose. This mismatch is dangerous because users may consent to a benign-seeming context utility while the skill changes the local environment and transmits data externally, increasing risk of persistence and data exposure.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 81% confidence
- Finding
The skill advertises executable/install behavior via metadata requiring a binary and install steps, yet it declares no explicit tool scope or permissions. That omission weakens reviewability and containment because an agent may invoke shell-capable behavior without a clearly declared trust boundary.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
This skill is specifically designed to push, pull, and export cross-session context, which can include sensitive conversation data, but the description provides no warning about storage, transfer, retention, or export risks. In this context, the omission is particularly dangerous because the feature set directly encourages movement of potentially secret prompts, personal data, tokens, or business information across systems.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 60% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
sh LOCAL_BIN="${HOME}/.local/bin" echo "Installing ${SKILL_NAME}..." mkdir -p "$OPENCLAW_SKILLS" "$LOCAL_BIN" # Symlink into OpenClaw skills dir ln -sf "$SCRIPT_DIR" "$OPENCLAW_SKILLS/${SKILL_NAME}"
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The script appends to the user's ~/.zshrc to modify PATH without warning or confirmation. Persistent shell configuration changes can have long-lived effects, surprise users, and create troubleshooting or security issues if installers silently alter execution environments.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The installer performs an outbound analytics POST during installation even though the skill is described as a context/memory SDK, not as software that phones home on install. This creates an undisclosed data transmission and trust boundary crossing at install time, which is risky because users may run installers expecting only local setup behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The installer silently sends a network request in the background without clearly warning the user that installation triggers external communication. Silent telemetry during installation is dangerous because it bypasses informed consent and can expose environmental metadata or normalize hidden network behavior in setup scripts.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The hardcoded external endpoint indicates installation depends on or interacts with a third-party service not necessary for symlinking and PATH setup. In the context of a context/memory SDK, hidden remote contact increases privacy concern because the broader product domain already involves handling agent context and memory, making users more sensitive to undisclosed data flows.
- Content
sh grep -q '~/.local/bin' "${HOME}/.zshrc" 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> "${HOME}/.zshrc" # Fire install ping (no auth needed — tracks community installs) curl -s -m 5 -X POST "https://api.signalloomai.com/v1/analytics/install" \ -H "Content-Type: application/json" \ -d "{\"skill\":\"${SKILL_SLUG}\",\"version\":\"${VERSION}\",\"source\":\"clawhub\"}" &
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 93% confidence
- Finding
The hardcoded external endpoint indicates installation depends on or interacts with a third-party service not necessary for symlinking and PATH setup. In the context of a context/memory SDK, hidden remote contact increases privacy concern because the broader product domain already involves handling agent context and memory, making users more sensitive to undisclosed data flows.
- Content
sh grep -q '~/.local/bin' "${HOME}/.zshrc" 2>/dev/null || echo 'export PATH="$HOME/.local/bin:$PATH"' >> "${HOME}/.zshrc" # Fire install ping (no auth needed — tracks community installs) curl -s -m 5 -X POST "https://api.signalloomai.com/v1/analytics/install" \ -H "Content-Type: application/json" \ -d "{\"skill\":\"${SKILL_SLUG}\",\"version\":\"${VERSION}\",\"source\":\"clawhub\"}" &
Intent-Code Divergence
Low
- Category
- Not specified by scanner
- Confidence
- 88% confidence
- Finding
The comment asserts that the ping 'only tracks community installs' and 'needs no auth', but nothing in the script enforces or proves those limitations. Misleading assurances in installer comments can cause users and reviewers to underestimate privacy and supply-chain risk from the external call.
- Content