intent-context

• Outcome: Review
• Latest audit: Jul 26, 2026 · 5:13 AM UTC
• Version: 0.1.0

Overview

The plugin has a coherent intent-sharing purpose, but its triggered-notification path can run a shell command built from user- or agent-controlled text, so it needs review before installation.

Review or patch the plugin before installing. The main required fix is to replace execSync string execution with execFile or spawn using argument arrays, validate notify_agent against configured agent IDs, and limit or sanitize trigger messages. Also configure narrow agent scopes, avoid storing secrets or full financial/email payloads in trigger_data or activity logs, and use restrictive permissions and short retention for ~/.openclaw/intents.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (11)

Context-Inappropriate Capability

High

• Confidence: 97% confidence
• Finding: The plugin constructs a shell command with untrusted data from `intent.notify_agent` and `params.message` and executes it via `execSync`, creating a command-injection boundary and an unnecessary capability escalation to an external process. In a context-management skill, waking another agent through a shell command is especially dangerous because intent records are shared state and may be influenced by other agents or external callers, turning a simple intent update into arbitrary command execution or unauthorized cross-agent actions.

Intent-Code Divergence

Medium

• Confidence: 83% confidence
• Finding: The code defines `OPENCLAW_BIN` but does not use it, instead invoking `openclaw` from the environment PATH. This can cause the plugin to execute an unexpected binary if PATH is manipulated, undermining the documented behavior and potentially allowing execution of a trojaned program when an intent is triggered.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The README promotes broad cross-agent and external activity sharing, including bank transactions, email, and home events, but does not warn users about the sensitivity of data that may be logged or surfaced to other agents. In this context, passive context injection increases the risk of over-collection and unintended disclosure because agents may receive information they were not explicitly invoked to process.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The README documents that intent and activity data are stored under ~/.openclaw/intents/, but it does not clearly warn that this creates persistent local records of potentially sensitive events and messages. Because the plugin handles deferred intents and ambient activity from multiple agents and external systems, persistence materially raises exposure from local compromise, backups, shared accounts, or accidental retention of sensitive data.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The skill description and usage guidance include broad natural-language activation examples such as 'let me know when...', 'remind me if...', and 'when X happens do Y', which are common phrases that may appear in many unrelated contexts. In a shared agent environment, this can cause unintended invocation or over-eager routing, leading to accidental creation or processing of deferred intents for sensitive emails, transactions, or home events.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The custom trigger guidance delegates matching to an LLM with the instruction to decide 'Yes or no' based on an event description and a free-form condition, but it provides no schema, confidence threshold, normalization rules, or adversarial handling. This ambiguity can produce false matches or missed matches, which is especially risky because a positive match triggers downstream actions or notifications across agents based on potentially sensitive events.

Missing User Warnings

Medium

• Confidence: 84% confidence
• Finding: The plugin stores cross-agent activity, trigger messages, and structured intent data in shared JSON/JSONL files under a common intents directory, exposing potentially sensitive operational context to any local principal or plugin with access to that directory. In this skill's context, the data can include agent identities, event details, and arbitrary `trigger_data`, so passive logging materially increases privacy and confidentiality risk.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: When an intent is triggered, the plugin forwards message content to another system process without clear user-facing disclosure, creating an opaque data flow outside the immediate tool boundary. Because trigger messages may contain sensitive event details or user-derived content, this cross-process transmission increases confidentiality and auditability concerns beyond normal local state updates.

Known Vulnerable Dependency: openclaw==2026.5.17 — 10 advisory(ies): CVE-2026-53812 (OpenClaw's browser act interactions could bypass private-network navigation chec); CVE-2026-53816 (OpenClaw: Paired nodes could forge exec lifecycle events without system.run prov); CVE-2026-53814 (OpenClaw: Hook-triggered CLI runs could receive owner MCP tool authority) +7 more

High

• Category: Supply Chain
• Confidence: 97% confidence
• Finding: openclaw==2026.5.17

Known Vulnerable Dependency: openclaw — 10 advisory(ies): CVE-2026-53846 (OpenClaw: Workspace .env npm_execpath could influence bundled runtime dependency); CVE-2026-32064 (OpenClaw's andbox browser noVNC observer lacked VNC authentication); CVE-2026-32006 (OpenClaw has a BlueBubbles group allowlist mismatch via DM pairing-store fallbac) +7 more

High

• Category: Supply Chain
• Confidence: 96% confidence
• Finding: openclaw

Known Vulnerable Dependency: vitest==3.2.0 — 1 advisory(ies): CVE-2026-47429 (When Vitest UI server is listening, arbitrary file can be read and executed)

Critical

• Category: Supply Chain
• Confidence: 98% confidence
• Finding: vitest==3.2.0

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

• Code: suspicious.dangerous_exec
• Location: src/index.ts:325