Security audit

OpenClaw Context Budget

Security checks for vulnerabilities and agentic risk

Overview

This skill is a disclosed OpenClaw configuration helper that only changes model context-window settings after user confirmation.

Install this only if you want an agent to inspect OpenClaw model configuration and potentially update model context-window values. Review the proposed diff before confirming, because contextWindow changes can affect runtime behavior; avoid confirming changes based on unofficial or unresolved vendor sources.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (7)

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The documented primary trigger phrase '上下文检查' is broad enough to overlap with ordinary user requests about inspecting context, which can cause this write-capable skill to activate when the user did not specifically intend configuration changes. In this skill’s context, that matters because even though the flow claims confirmation before writing, accidental activation still expands the chance of unnecessary config inspection, misleading prompts toward mutation, or social-engineering the user into approving changes.

Vague Triggers

Medium

Confidence: 91% confidence
Finding: The README advertises plain-language trigger phrases such as "检查上下文", "优化上下文", and "context check," which are broader than the stricter activation policy described elsewhere in the skill metadata. In hosts that activate skills by fuzzy matching user utterances, these examples can cause unintended invocation during ordinary discussion about context or prompts, leading the agent into a config-inspection and potential config-modification workflow the user did not clearly request.

Vague Triggers

Medium

Confidence: 90% confidence
Finding: The trigger list includes broad natural-language variants such as '检查上下文', '优化上下文', and '我换模型了，把窗口配上', which go beyond the stricter explicit-intent set described in the metadata. This creates a real risk of unintended activation during ordinary conversation about context or model changes, leading the agent into configuration discovery and a write-capable workflow that can modify runtime settings after minimal confirmation.

Natural-Language Policy Violations

Medium

Confidence: 93% confidence
Finding: This file contains prominent user-facing text in Chinese ('把上下文窗口配成官方标称的 60%' and '检测 → 决策 → 执行') while the surrounding metadata and structure are otherwise language-neutral/English. Because the file does not indicate that Chinese is optional, user-selected, or required for a region-specific purpose, it appears to impose a specific language without opt-in.

Intent-Code Divergence

Medium

Confidence: 95% confidence
Finding: The design doc broadens activation beyond the manifest’s explicitly allowed intents by stating that mentions of '上下文' plus generic inspection verbs can trigger the skill. In an instruction-driven agent, this mismatch can cause the skill to activate on ordinary discussion about context or prompts, leading to unauthorized configuration discovery or patch preparation outside the user’s narrowly-scoped consent.

Vague Triggers

Medium

Confidence: 97% confidence
Finding: The trigger rule is overly broad and overlaps with common conversational language, increasing the chance of accidental invocation. Because this skill reads configuration, inspects enabled models, and can progress toward config changes after minimal prompting, false activation undermines the stated requirement that it only be used when explicitly requested.

Natural-Language Policy Violations

Low

Confidence: 82% confidence
Finding: 文档主体及描述字段大量以中文固定表述技能内容，且未见提供语言选择或明确的用户 opt-in 说明。若该技能面向通用用户或多语言环境，这种默认固定语言可能构成自然语言层面的 locale 策略不一致。

Static analysis

No suspicious patterns detected.