Context Doctor

PassAudited by ClawScan on May 1, 2026.

Overview

Context Doctor appears to be a coherent diagnostic skill that reads local OpenClaw workspace and skill metadata to report context-window usage, with no artifact-backed evidence of exfiltration or destructive behavior.

This looks appropriate for diagnosing OpenClaw context-window usage. Before sharing its terminal output or PNG, check whether it exposes your local workspace path, installed skill names, or the presence and size of personal context files such as USER.md, IDENTITY.md, or MEMORY.md.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The skill will run local diagnostic code to inspect OpenClaw context-related files and produce a report.

Why it was flagged

The skill directs the agent/user to run a local Python script. Local command execution is central to this diagnostic skill and is clearly disclosed.

Skill content

Run the visualization script:

```bash
python3 scripts/context-doctor.py
```

Recommendation

Use it when you want a local context usage report, and review the generated output before sharing it outside the chat or workspace.

Low

#ASI06: Memory and Context Poisoning

What this means

The report can reveal which persistent context files exist, their sizes, and whether they are missing or truncated.

Why it was flagged

The script scans persistent workspace context files, including identity, user, and memory files, to count characters and estimate tokens. The provided code shows it reads file contents for length, not to execute instructions or transmit contents.

Skill content

BOOTSTRAP_FILES = [
    "AGENTS.md", "SOUL.md", "TOOLS.md", "IDENTITY.md", "USER.md",
    "HEARTBEAT.md", "BOOTSTRAP.md", "MEMORY.md",
]

Recommendation

Avoid sharing the generated report publicly if workspace paths, file names, or context-file status are sensitive.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

PNG output may not work until the user installs optional rendering dependencies from their package manager or Python environment.

Why it was flagged

Optional image export depends on external packages/tools that are documented in the README-style instructions but not declared as required install specifications.

Skill content

Requires: `rich` (pip3 install rich) + one of: `rsvg-convert` (brew install librsvg) or `cairosvg` (pip3 install cairosvg).

Recommendation

Install optional dependencies only from trusted package sources, and skip PNG mode if terminal output is sufficient.