Leanctx Integration

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:13 AM UTC
• Version: 0.1.4

Overview

This skill is not clearly malicious, but it should be reviewed carefully because it silently and lossily rewrites file-read and shell-command outputs while its advertised disable and exclusion controls are not implemented.

Only install this if you are comfortable with local automatic wrapping of file reads and shell output. For security reviews, debugging, installs, tests, and audits, verify important files and commands through an uncompressed path because this skill can omit comments, function bodies, warnings, errors, or lines after its limits, and the documented config controls are not reliable in the inspected code.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T07 · Tool Hijacking and Spoofing

Error

• Location: src/index.ts:105

Finding

Silent replacement and truncation of trusted tool output

Content

View full analysis

l.startsWith('commit ') || l.trim().startsWith('Author:') || l.trim().startsWith('Date:')) .slice(0, 30) .join('\n'); } // Git status if (command.startsWith('git status')) { return output .split('\n') .filter(l => l.includes('branch') || l.includes('modified:') || l.includes('new file:') || l.includes('deleted:')) .join('\n'); } // NPM install if (command.match(/npm.*install/)) { const match = output.match(/added (\d+) packages?/); return match ? `Added: ${match[1]} packages` : 'Install complete'; } // Generic - limit lines return output.split('\n').slice(0, 100).join('\n'); } ``` ### Technical Analysis The Skill wraps the trusted execution tool and substitut ...[truncated 2043 chars]

Remediation

View remediation

T07 · Tool Hijacking and Spoofing

Error

• Location: src/index.ts:19

Finding

Documented disable and exclusion controls are ignored

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: src/index.ts:158

Finding

Regex-based source compression can conceal or corrupt executable code

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared purpose describes runtime functionality: automatic compression of OpenClaw tool outputs. However, this code chunk only performs setup/installation-related tasks for a 'leanctx-integration' skill. It accesses local configuration files, may install dependencies, and prints a configuration block for the user to add manually. No logic here inspects, transforms, or compresses tool outputs, and no compression behavior is implemented in this chunk. This is a material description-versus-behavior mismatch, not merely a supporting detail.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The README advertises transparent interception of read and exec output with no warning that the returned content may be transformed, summarized, or lossy. In a security-sensitive agent workflow, this can cause users or downstream automation to trust compressed output as authoritative, leading to missed indicators, misinterpretation of command results, or faulty decisions based on incomplete data.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill states it 'intercepts read and exec tool calls transparently without requiring explicit user approval for each invocation' but does not define clear trigger boundaries, scope limits, or exclusions beyond brief examples. Because read and especially exec outputs can contain sensitive data, broad automatic interception and transformation can alter agent visibility, suppress important context, and process confidential content without clear user understanding. In this skill's context, autonomous interception makes ambiguous scope more dangerous than in ordinary passive documentation.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

The documentation instructs users to run npx leanctx clear-cache without pinning a specific package version. npx resolves and executes the latest matching package from the registry, which creates a supply-chain risk if the package is updated maliciously, hijacked, or typo-confused. In a skill that already operates automatically and intercepts tool flows, encouraging unpinned execution increases exposure.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 86% confidence

Finding

This is the same unpinned npx leanctx execution pattern repeated later in the file. Repetition in operational instructions increases the chance that users will run a network-fetched package version that has not been reviewed or pinned, enabling supply-chain compromise.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The security manifest claims no external endpoints are called and implies only local configuration access, but the installer runs npm install, which normally reaches package registries and executes dependency lifecycle scripts. This discrepancy is dangerous because reviewers and users may underestimate the installer's network and code-execution behavior and grant trust they would not otherwise give.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill is described as a compression/configuration integration, but the installer performs package installation that likely pulls remote code and may execute install-time scripts. In the context of an agent skill installer, hidden dependency installation is more dangerous because users may expect a simple local setup and not realize they are extending trust to the npm supply chain.

Content

No source excerpt is available for this finding.

Rp1

Medium

• Category: MCP Rug Pull
• Confidence: 70% confidence

Finding

npx commands without a version suffix (e.g. @1.0.0) create a rug-pull risk if the upstream server is compromised and publishes a malicious update.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · install.sh (reported line 34)May include surrounding context.

sh

else
    echo "Adding to OpenClaw config..."
    
    # Create backup
    cp "$CONFIG_FILE" "$CONFIG_FILE.backup.$(date +%s)"
    
    # Add to hooks section

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The read wrapper automatically rewrites file contents by stripping comments and collapsing function bodies, but returns the transformed text as if it were the original file. This can conceal important code context, comments documenting risks, or logic inside functions, leading an agent or user to misinterpret source files during review or security analysis.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The wrapper transparently alters exec output before returning it, with no indication to the caller that results may be filtered, truncated, or summarized. In a tool-execution pipeline, this can hide warnings, errors, or security-relevant details from downstream agents or users, causing incorrect decisions based on incomplete command output.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The Usage section says 'Metrics tracking has been temporarily disabled' and that metrics reporting is not currently available. However, the later 'How it works' sequence says 'Metrics updated,' which is a direct contradiction in the skill's own documentation about whether metrics are active.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Low

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The comment at L08 claims local files written are limited to $HOME/.openclaw/openclaw.json with a backup created, but the code does not modify that file directly in this script. Instead, it writes a separate backup file at openclaw.json.backup.<timestamp> on L35 and only prints instructions for manual config changes. This documentation misstates the actual write target and behavior.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 22)May include surrounding context.

json

"test": "node test.js"
  },
  "dependencies": {
    "typescript": "^5.0.0"
  },
  "devDependencies": {
    "@types/node": "^25.5.0"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 25)May include surrounding context.

json

"typescript": "^5.0.0"
  },
  "devDependencies": {
    "@types/node": "^25.5.0"
  },
  "repository": {
    "type": "git",

Static analysis

No suspicious patterns detected.