ClawHub
Back to skill

Security audit

Context Engine

Security checks across malware telemetry and agentic risk

Overview

This is a disclosed local project-memory skill that stores context on disk, with privacy considerations but no evidence of hidden exfiltration or destructive behavior.

Install only if you are comfortable with project context, notes, pending tasks, recent files, and recent commands being stored locally in the documented projects directory and restored across sessions. Avoid using it for sensitive work unless you plan to review and clean up the JSON files, and consider adjusting the hardcoded storage path for your environment.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Vague Triggers

Medium
Confidence
83% confidence
Finding
The changelog states the skill is triggered by 'session_start, explicit mentions, heartbeat', and 'heartbeat' is a broad automatic activation condition that can cause the skill to run without a clear, user-initiated boundary. In a skill that persists project context and restores it automatically, ambiguous triggers increase the chance of unintended data access, context leakage, or surprise state changes across sessions.

Missing User Warnings

Medium
Confidence
92% confidence
Finding
The changelog describes saving topic, file, command, pending tasks, and notes to persistent storage under /home/deus/.openclaw/workspace/memory/projects/ and restoring that context on session start, but provides no indication of user warning, consent, retention controls, or scope limitation. This creates a real risk of sensitive information being silently retained and reintroduced into later sessions, potentially exposing private data or causing the agent to act on stale or unintended context.

Vague Triggers

Medium
Confidence
88% confidence
Finding
The trigger list includes broad phrases such as "project" and common conversational requests like "what are we working on," which can cause the skill to activate during ordinary discussion rather than clear user intent to invoke persistence features. In a memory/context skill, accidental activation is more dangerous because it may save, restore, or expose project state without the user explicitly consenting in that moment.

Missing User Warnings

Medium
Confidence
95% confidence
Finding
The skill describes automatic restore, periodic heartbeat saves, and session-end persistence, but it does not present a clear user-facing warning that conversation content and activity data are being written to disk. This creates a transparency and privacy risk because users may disclose sensitive information without realizing it will be retained across sessions in local files.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.