Context Handoff

• Outcome: Review
• Latest audit: Sep 12, 2026 · 5:50 AM UTC
• Version: 0.1.2

Overview

This is a coherent local context save/restore helper, but it needs review because unsafe name handling and default overwrites could read or replace unintended Markdown files.

Review this skill before installing. Use only simple slot and project names, avoid path characters such as slashes or '..', and do not store secrets in summaries. A safer version should enforce an allowlist for names, verify resolved paths stay inside the intended directories, and ask before overwriting existing files.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:36

Finding

Unsanitized Context Names Permit Path Traversal

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 36-58, 85-86, 111-112, 139-140, and 164-165
Vulnerability Type: Path traversal through user-controlled file names
Risk Level: High

Vulnerable Code Snippets

md

- `handoffs/sessions/<slot>.md`

md

- `projects/<project-name>.md`

项目名由用户指定；如果没有指定，先问。

md

3. 写入：
   - `/root/.openclaw/workspace/handoffs/sessions/<slot>.md`

md

2. 读取：
   - `/root/.openclaw/workspace/handoffs/sessions/<slot>.md`

md

3. 写入：
   - `/root/.openclaw/workspace/projects/<project-name>.md`

md

2. 读取：
   - `/root/.openclaw/workspace/projects/<project-name>.md`

Technical Analysis

The Skill directly interpolates the user-provided slot or project-name into filesystem paths used for read and overwrite operations. Although it requires users to provide these names, it defines no validation rules, canonicalization procedure, or containment check.

A crafted value containing parent-directory components such as ../ can resolve outside the intended handoffs/sessions or projects directory. Appending .md limits likely targets to Markdown files but does not prevent traversal.

Because restore operations read and summarize the resolved file, this can expose accessible Markdown content. Because save operations overwrite the resolved file by default, it can also corrupt or replace accessible Markdown files. Actual reach depends on the filesystem permissions of the Agent process and the path produced after normalization.

Attack Path

1. An attacker requests a session-context or project-summary save or restore operation.
2. When prompted for a slot or project name, the attacker supplies a traversal value such as ../../projects/target.
3. The Skill constructs a path by inserting that value directly into the documented path template.
4. Filesystem path normalization resolves the target outside the intended storage directory.
5. For a restore operation, the Agent reads and s ...[truncated 637 chars]

Remediation

View remediation

Remediation Suggestions

1. Accept only simple identifiers matching a strict allowlist, for example:

   regex

   ^[A-Za-z0-9][A-Za-z0-9_-]{0,63}$
   

2. Reject absolute paths, . and .. components, path separators, alternate separators, control characters, null bytes, and encoded separator variants.

3. Construct the target from a fixed trusted base directory, resolve it canonically, and verify that the resolved path remains beneath that base directory before every read or write.

4. Apply the same validation and containment controls to both session slots and project names.

5. Reject symlinks and require the destination or source to be a regular file inside the approved directory.

6. For writes, use safe file-creation APIs and atomic replacement. Avoid following symlinks and consider requiring confirmation before replacing an existing file.

7. Add tests covering traversal inputs such as ../target, ../../projects/target, absolute paths, mixed separators, and symlink-based escapes.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger list contains many broad, natural-language phrases such as '记下这次讨论', '读取上次摘要', and 'continue last discussion' that could match ordinary conversation and invoke filesystem actions unexpectedly. In this skill, unintended invocation is more dangerous because the skill can read from and write to persistent local files, potentially causing unanticipated data persistence or disclosure across sessions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill instructs the agent to create directories and overwrite local files under fixed filesystem paths, but it does not require explicit user-facing warning or confirmation that persistent local storage will be modified. This is risky because users may think they are only asking for a conversational summary, while the agent is actually performing durable filesystem writes that can retain sensitive project context across sessions.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The writing requirements explicitly require summaries to be written in Chinese, which forces a specific language regardless of user preference. This is a natural-language policy concern because the file does not offer a language choice or indicate that Chinese is optional or context-dependent.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.