ClawHub
Back to skill

Security audit

Multi-Chat Context Manager

Security checks for vulnerabilities and agentic risk

Overview

This is a small manual CLI for saving chat context locally, with real privacy caveats but no evidence of hidden, remote, or malicious behavior.

Install only if you are comfortable with chat history being stored locally in plaintext under the skill directory. Avoid storing secrets or sensitive customer data, and be careful with list and clear because list exposes all saved contexts and clear with no channel removes them all.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/context_manager.py:21
Finding

Conversation Data Stored in an Unprotected Plaintext File

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Findings (11)

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.

md
Retrieve context:
python3 scripts/context_manager.py retrieve --channel "telegram-123" --user "user-456"

Clear context:
python3 scripts/context_manager.py clear --channel "telegram-123"

List all contexts:

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/context_manager.py (reported line 72)May include surrounding context.

python
Retrieve context:
python3 scripts/context_manager.py retrieve --channel "telegram-123" --user "user-456"

Clear context:
python3 scripts/context_manager.py clear --channel "telegram-123"

List all contexts:

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/context_manager.py (reported line 109)May include surrounding context.

python
Retrieve context:
python3 scripts/context_manager.py retrieve --channel "telegram-123" --user "user-456"

Clear context:
python3 scripts/context_manager.py clear --channel "telegram-123"

List all contexts:

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · SKILL.md (reported line 17)May include surrounding context.

md
#!/usr/bin/env python3
"""
Multi-Chat Context Manager
Store, retrieve, and clear conversation contexts per channel/user.
"""

import json

Memory Manipulation

High
Category
Memory Poisoning
Confidence
80% confidence
Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · scripts/context_manager.py (reported line 4)May include surrounding context.

python
#!/usr/bin/env python3
"""
Multi-Chat Context Manager
Store, retrieve, and clear conversation contexts per channel/user.
"""

import json

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill advertises executable capabilities via Python and describes file-backed context storage, but it does not declare any explicit tool scope such as permissions or allowed-tools. That mismatch increases the risk of overbroad execution in hosts that rely on manifest scoping, especially because the skill can read/write plaintext context data and invoke a shell command.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The tool persists full conversation content, including user messages and agent responses, to a local JSON file without any notice, consent flow, or sensitivity controls. In a chat-context skill, stored data is likely to include secrets, personal data, or proprietary information, so silent persistence increases confidentiality and privacy risk if the host is shared, backed up, or later accessed by other processes or users.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
97% confidence
Finding

Calling clear with no channel causes the program to erase all stored contexts, yet the CLI does not require confirmation or a force flag before performing this destructive action. In a context-management tool, this can lead to accidental mass deletion of conversation history and operational disruption, especially in scripts or multi-user workflows.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_context_manager.py (reported line 65)May include surrounding context.

python
def test_cli():
    """Test command-line interface."""
    # Test store via subprocess
    result = subprocess.run([
        sys.executable, 
        os.path.join(os.path.dirname(__file__), '..', 'scripts', 'context_manager.py'),
        'store',

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_context_manager.py (reported line 80)May include surrounding context.

python
print("✓ CLI store passed")
    
    # Test retrieve
    result = subprocess.run([
        sys.executable,
        os.path.join(os.path.dirname(__file__), '..', 'scripts', 'context_manager.py'),
        'retrieve',

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · tests/test_context_manager.py (reported line 93)May include surrounding context.

python
print("✓ CLI retrieve passed")
    
    # Clean up
    subprocess.run([
        sys.executable,
        os.path.join(os.path.dirname(__file__), '..', 'scripts', 'context_manager.py'),
        'clear',

Static analysis

No suspicious patterns detected.