T02 · Agent Memory Poisoning
Warning
- Location
scripts/context-engine.js:149- Finding
Persistent Untrusted Context Can Poison Future Agent Sessions
- Content
View full analysis
- Remediation
View remediation
Security audit
Context Engine
Security checks for vulnerabilities and agentic risk
Overview
This memory skill is coherent, but needs Review because it automatically persists and restores prior project context, commands, notes, and tasks across sessions with broad triggers and limited user controls.
Review this before installing if you do not want prior conversations, notes, tasks, filenames, or command text to reappear in future sessions. Avoid saving secrets, consider narrowing triggers to explicit commands, and require clear controls for inspecting, deleting, disabling, and permission-hardening the stored memory files.
Vulnerability Patterns
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
T09 · Insecure Skill Coding Practices
Note
- Location
scripts/context-engine.js:14- Finding
Sensitive Context Files Are Created Without Explicit Restrictive Permissions
- Content
View full analysis
- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (3)
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 84% confidence
- Finding
Session persistence is an intentional feature of this memory skill, but it still introduces security and privacy risk because prior context can be automatically restored into a new session. In this context, the danger is elevated by automatic behavior and broad triggers, which can expose historical notes, tasks, or command history when not expected by the user.
- Content
md --- name: context-engine description: Smart Context Engine - Maintains conversation state and project continuity across OpenClaw sessions. Tracks active projects, saves/restores context, and provides project management. Use when: (1) starting a new session and wanting to restore previous context, (2) working on a specific project and wanting to track progress, (3) switching between projects, (4) asking "what are we working on" or "where did we leave off", (5) wanting to save current context manually. metadata: claname: context-engine
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill describes automatic restore and periodic saving behavior but does not clearly warn that conversation state, last command, notes, and related session data are written to disk. This creates a transparency and privacy risk because users may disclose sensitive information without realizing it will persist locally across sessions.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The trigger list includes the generic term "project," which can cause the skill to activate during normal conversation unrelated to explicit consent to use persistence features. Because this skill can save, restore, and switch stored context, unintended invocation increases the chance of unexpected state changes or disclosure of previously stored project information.
- Content
Static analysis
No suspicious patterns detected.