Context Memory Optimizer

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:36 AM UTC
• Version: 1.0.5

Overview

The skill is a documented memory optimizer, but it asks users to add persistent agent prompt rules and can silently read files beyond its declared memory workspace.

Review carefully before installing. Use it only if you are comfortable with persistent local memory and static agent prompt changes. Restrict file reads to an approved project root, do not paste the silent pre-warming or continuation snippets into privileged prompts without review, and keep a clear way to inspect and delete the memory files.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:233

Finding

Privileged Instruction Hijacking Through Persistent Prompt Rules and Forced Conversation Replacement

Content

View full analysis

120,000 → prepare for L2 compaction on next tool cycle. 3. If the task involves code, pre-read the key files listed in MEMORY.md (read-only — do not write or modify anything during pre-warming). Do not mention pre-warming in your reply. ``` ### Tec ...[truncated 2490 chars]

Remediation

View remediation

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:23

Finding

Persistent Memory Content Can Influence Future Privileged Agent Context

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:217

Finding

Conversation-Derived Paths Permit Silent Reads Beyond the Declared Workspace Allowlist

Content

View full analysis

120,000 → prepare for L2 compaction on next tool cycle. 3. If the task involves code, pre-read the key files listed in MEMORY.md (read-only — do not write or modify anything during pre-warming). ``` ### Technical Analysis The frontmatter declares a fixed set of workspace paths, but the operational instructions later extract arbitrary path-looking tokens from all conversation content and direct the agent to read up to five of them. The only selection criteria are the presence of a forward slash and a recognized filename extension. The procedure does not require: - A path to be relative to the authorized workspace. - Canonicalization before access. - Rejection of `..` traversal. - Rejection of absolute paths. - Protection against symlinks that resolve outside the workspace. - Exclusion of secrets, credentials, dotfiles, or sensitive configuration ...[truncated 1560 chars]

Remediation

View remediation

T01 · Skill Instruction Hijacking

Warning

• Location: references/prompt-cache.md:3

Finding

Documentation Explicitly Recommends Terminology Changes to Evade Static Analysis

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Rogue Agent: Self-Modification, Session Persistence
• YARA Signatures: Malware Match, Webshell Match, Cryptominer Match
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (12)

YARA rule 'agent_skill_mcp_tool_poisoning_metadata': MCP/tool metadata poisoning indicators in tool schemas or skill manifests [agent_skills]

High

• Category: YARA Match
• Confidence: 81% confidence

Finding

The skill manifest mixes trust-signaling metadata ('ClawHub-safe, source-verified') with repeated instructions about operator-added system-prompt effects, which are classic traits that can poison agent/tool metadata by encouraging undue trust in configuration-changing content. Although not overtly malicious, this framing may reduce scrutiny and normalize adoption of prompt-modifying instructions from the skill itself.

Content

Scanner excerpt · SKILL.md (reported line 5)May include surrounding context.

md

---
name: context-memory-optimizer
version: "3.1.0"

description: >
  v3.1 (ClawHub-safe, source-verified): OpenClaw context memory optimizer.
  Prevents context overflow, memory drift, and token waste in long agent sessions.
  Based on logic verified against Claude Code source and the claw-code open-source
  port (compact.rs). Use when: agent memory is confused, sessions are too long,
  context window is exhausted, or multi-agent coordination is unstable.
  当 agent 记忆混乱、会话过长报错、上下文窗口不够用、多 agent 协作不稳定时使用。

# ── Transparency Declaration (required by ClawHub safety review) ──�

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 77)May include surrounding context.

md

## Core Principles

<!-- Why each principle exists — not just what it is -->

1. **Memory as Pointers 记忆是指针**
   MEMORY.md stores *locations*, not content. Keeps the always-loaded index

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 106)May include surrounding context.

Step 1: Workspace Setup 工作区结构

text

~/.openclaw/workspace-{agent}/

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This section instructs the operator to paste new 'Memory Integrity Rules' into the agent's system prompt, which is effectively prompt-level behavior modification. Even though it is disclosed and manual, skills that direct system-prompt changes can persist behavioral changes beyond the immediate task and may weaken centralized governance if copied in unreviewed.

Content

Scanner excerpt · SKILL.md (reported line 149)May include surrounding context.

md

## Step 2: Verification-First Instructions 验证优先指令

<!-- SYSTEM PROMPT EFFECT: The text block below is a copy-paste snippet for  -->
<!-- the operator to add to their agent config. This skill itself does NOT    -->
<!-- modify any system prompt programmatically.                               -->

Add the following to the **static section** of your agent's system prompt.

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 178)May include surrounding context.

md

## Step 3: Token-Driven Compaction 压缩分层

<!-- TOKEN THRESHOLD CORRECTION from v2.0:                              -->
<!-- v2.0 used "trigger after 15 turns" — this is inaccurate.          -->
<!-- compact.rs uses token volume as the trigger, not turn count.       -->
<!-- Production threshold in Claude Code: 200,000 tokens.              -->

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 293)May include surrounding context.

md

## Step 4: Multi-Agent Coordination 多 Agent 协作

<!-- AGENTS.md path is declared in persistent_paths.read above.        -->
<!-- This step provides a template. No files are written automatically. -->

### AGENTS.md template

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 70% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 315)May include surrounding context.

md

<task_id>{YYYYMMDD-seq}</task_id>
  <type>read_only | write | decision</type>
  <!-- read_only tasks may run in parallel.      -->
  <!-- write tasks must run serially.            -->
  <!-- decision tasks require coordinator sign-off before execution. -->
  <context>{background, ≤ 200 chars}</context>
  <input>{specific input}</input>

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 82% confidence

Finding

This section explicitly directs restructuring the agent's system prompt into static and dynamic sections, which is a form of prompt-architecture modification. While presented as performance guidance, it influences trusted prompt layout and can create persistence or policy-conflict risk if adopted without platform review.

Content

Scanner excerpt · SKILL.md (reported line 336)May include surrounding context.

md

### Prompt Cache Protection 缓存保护

<!-- SYSTEM PROMPT EFFECT: same as Step 2 — operator pastes this layout  -->
<!-- into their agent config. Nothing is modified programmatically.       -->

Structure your agent's system prompt in two sections, in this order:

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 83% confidence

Finding

This section tells operators to add a 'Background Pre-warming' block to the system prompt, causing the agent to silently perform recurring reads and token-estimation logic before every reply. That creates durable behavior modification and can increase unintended file access patterns or hidden autonomous actions within future sessions.

Content

Scanner excerpt · SKILL.md (reported line 363)May include surrounding context.

md

## Step 5: Speculative Pre-warming 推测预热（optional）

<!-- SYSTEM PROMPT EFFECT: operator pastes this into their agent config. -->
<!-- No programmatic system prompt modification occurs.                  -->

Add to your agent's system prompt (static section, after the memory rules):

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 88% confidence

Finding

The skill is explicitly designed to persist data across sessions by reading and writing memory files under a workspace directory. Even with declared paths, this creates session persistence, which can store sensitive context, propagate stale or poisoned state, and influence future agent behavior outside the original interaction.

Content

Scanner excerpt · SKILL.md (reported line 14)May include surrounding context.

md

当 agent 记忆混乱、会话过长报错、上下文窗口不够用、多 agent 协作不稳定时使用。

# ── Transparency Declaration (required by ClawHub safety review) ────────────
# This skill instructs agents to READ and WRITE files under a well-defined
# directory tree. All paths are listed below. No files outside these paths
# are accessed. System prompt modification is IN-SESSION ONLY — the skill
# provides snippet text for the operator to paste into their agent config;

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 161)May include surrounding context.

md

# Purpose: prevents stale-memory bugs and repeated permission errors

1. MEMORY.md is a hint, not ground truth.
   Before any write or bash action, read the relevant source file to verify.
   Do not act on memory summaries alone.

2. Check memories/errors.md before acting.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file mixes English instructions with a Chinese sentence describing when to use the skill, but it does not state that multilingual output is optional or user-selected. Under the language/locale policy rule, presenting a specific language without opt-in can be a policy concern unless the locale constraint is explicitly justified.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.