Context Guardian

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 5:18 AM UTC
• Version: 1.1.7

Overview

This skill openly stores local checkpoints and summaries to help agents resume long tasks, with no evidence of hidden network access, credential use, or destructive behavior.

Install only for workspaces where local checkpoint files are acceptable. Configure a dedicated state directory, keep its permissions limited, and avoid placing secrets or sensitive raw outputs in task state or summaries.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: scripts/context_guardian.py:245

Finding

Persistent agent-memory poisoning through untrusted durable state and summaries

Content

View full analysis

"TaskState": plan = [TaskStep(**step) for step in payload.get("plan", [])] artifacts = [TaskArtifact(**artifact) for artifact in payload.get("artifacts", [])] last_action_payload = payload.get("last_action") last_action = LastAction(**last_action_payload) if last_action_payload else None return cls( task_id=payload["task_id"], session_id=payload["session_id"], goal=payload["goal"], status=payload.get("status", "idle"), current_phase=payload.get("current_phase", "initial"), plan=plan, completed_steps=list(payload.get("completed_steps", [])), open_issues=list(payload.get("open_issues", [])), decisions=list(payload.get("decisions", [])), constraints=list(payload.get("constraints", [])), important_facts=list(payload.get("important_facts", [])), artifacts=artifacts, last_action=last_action, next_action=payload.get("next_action", ""), recovery_instructions=list(payload.get("recovery_instructions", [])), state_confidence=float(payload.get("state_confidence", 0.0)), updated_at=payload.get("updated_at", iso_now()), ) ``` ```python def latest_task_state(self) -> TaskState | None: if not self.task_state_json.exists(): return None payload = json.loads(self.task_state_json.read_text(encoding="utf-8")) return TaskState.from_dict(payload) def latest_summary(self) -> str | None: if not self.summaries_dir.exists(): return None summaries = sorted(self.summaries_dir.glob("*.md")) if not summaries: return None return summaries[-1] ...[truncated 3999 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md

pts/context_guardian.py` governs the deterministic integration contract, while `SKILL.md` governs the mandatory agent execution behavior.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence

Finding

The skill explicitly requires durable state and summary file reads/writes as part of its runtime contract, but it does not declare any tool scope or permission boundaries for those file operations. That creates a real security and governance gap: hosts or agents may grant broader filesystem access than necessary, making accidental overwrites, leakage of sensitive files, or unsafe path selection more likely during integration.

Content

No source excerpt is available for this finding.

Behavior Manipulation

Medium

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Subtle instructions detected that may alter agent decision-making or introduce hidden biases.

Content

Scanner excerpt · references/implementation-notes.md (reported line 17)May include surrounding context.

md

Practical rule:
- Keep low-value conversation history out of the working bundle once durable state exists.
- Always prefer a fresh checkpoint over guessing.
- For OpenClaw-style hosts, a thin workspace-level wrapper CLI is a good integration pattern: it should reuse the reference module, stay small, and expose only the safest repetitive actions (`status`, `ensure`, `checkpoint`, `bundle`).
- If the host already knows its workspace root, prefer a session-level default (for example `CG_ROOT`) over forcing weak models to repeat a fragile `--root ...` flag on every call.
- Treat `summaries/latest-summary.md` as the canonical runtime alias for the newest summary, even when timestamped summaries are also kept for history.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The code persists detailed task state, summaries, checkpoints, and event logs to disk automatically, including goals, constraints, decisions, artifacts, file paths, and recent actions, without any built-in consent, disclosure, minimization, or protection controls. In an agent setting, this durable state can easily contain sensitive user prompts, secrets, internal file locations, or proprietary workflow data, creating confidentiality and privacy risk if the filesystem is shared, backed up, or later accessed by other users or processes.

Content

No source excerpt is available for this finding.

Missing User Warnings

Low

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The markdown explicitly states that the skill writes checkpoints and summaries to disk, but it does not include a user-facing warning about modifying workspace files or advise reviewing configured paths before use. Because this is a markdown file, the omission of a warning about data-affecting behavior fits the missing-user-warnings criterion.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.