Security audit

Context Compression

Security checks for vulnerabilities and agentic risk

Overview

This skill is mostly a disclosed local context-management tool, but it can automatically rewrite session history and persistent memory with enough data-loss and memory-poisoning risk to require review before installation.

Install only if you are comfortable with a local tool that can rewrite OpenClaw session history and persist extracted conversation content into memory files. Review the scripts before enabling cron, keep backups of session files, leave AI-assisted extraction disabled unless you accept provider-side handling of session content, and audit MEMORY.md/daily notes for accidental secrets or injected instructions.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (4)

T02 · Agent Memory Poisoning

Error

Location: identify-facts.sh:38
Finding: Untrusted conversation content can poison persistent agent memory
Content: View full analysis
/dev/null; then echo "" >> "$MEMORY_FILE" echo "## Truncated Facts - $today" >> "$MEMORY_FILE" echo "> Facts identified from truncated sessions on $today" >> "$MEMORY_FILE" echo "" >> "$MEMORY_FILE" fi echo "### Session: $session_name" >> "$MEMORY_FILE" cat "$temp_facts" >> "$MEMORY_FILE" echo "" >> "$MEMORY_FILE" fi ``` A related path in `identify-facts-enhanced.sh:129-154` also appends AI-generated output directly to the same persistent memory file: ```bash echo "### Session: $session_name" >> "$MEMORY_FILE" echo "\`\`\`" >> "$MEMORY_FILE" echo "$facts" >> "$MEMORY_FILE" echo "\`\`\`" >> "$MEMORY_FILE" echo "" >> "$MEMORY_FILE" ``` ### Technical Analysis The keyword extractor copies complete conversation text into `MEMORY.md` whenever the text matches a broad trigger. It does not distinguish trusted facts from imperative instructions, validate the author or message role, neutralize prompt-like content, or require confirmation before promoting data to long-term memory. Markdown code fences in the enhanced path provide display formatting only; they do not establish a security boundary for an agen ...[truncated 1451 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: identify-facts-enhanced.sh:19
Finding: Sensitive session content is stored in unsafe shared temporary paths
Content: View full analysis
"$content_file" ``` ### Technical Analysis The script uses a fixed directory beneath globally shared `/tmp` storage. It does not set a restrictive `umask`, verify directory ownership, reject symbolic links, or use `mktemp` to create files atomically. The file names are derived from process IDs, shell pseudo-random values, or second-resolution timestamps. Failed AI requests copy conversation content into a persistent plaintext pending file, and no expiration or cleanup process is provided for that copy. Depending on the host's default `umask` and whether an attacker can pre-create or influence the fixed directory, another local account or process may be able to discover, read, replace, or redirect these files. The retained content can contain private conversation history. ### Attack Path 1. A local attacker observes or pre-creates the fixed `/tmp/openclaw-fact-identification` path, or predicts a pending filename based on the current timestamp. 2. The user enables AI-assisted fact extraction. 3. The script writes up to approximately 8 KB of processed conversation content into that directory. 4. The attacker reads the plaintext file o ...[truncated 823 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: truncate-sessions-safe.sh:186
Finding: Reversed truncation search can destroy nearly all session history without the documented backup
Content: View full analysis
/dev/null || echo 0) local low=1 local high=$total_lines local result=$total_lines while [ $low -le $high ]; do local mid=$(( (low + high) / 2 )) local char_count=$(tail -n $mid "$file" | wc -c 2>/dev/null || echo 0) if [ "$char_count" -le "$max_chars" ]; then result=$mid high=$((mid - 1)) else low=$((mid + 1)) fi done echo $result } ``` ```bash keep_lines=$(find_truncate_point "$f" "$BUDGET_UNITS") if [ "$keep_lines" -gt 0 ] && [ "$keep_lines" -lt "$lines" ]; then ... head -1 "$f" > "$temp_file" tail -n $((keep_lines - 1)) "$f" >> "$temp_file" ... if mv "$temp_file" "$f" 2>/dev/null; then log " ✂️ Truncated (order preserved): ~${total_units}t ${lines}L → ~${new_units}t ${new_lines}L" ((truncated_count++)) fi fi ``` The compact-only branch also replaces the original directly: ```bash temp_file="${f}.trunc.$$" tail -n "$keep_lines" "$f" > "$temp_file" 2>/dev/null if mv "$temp_file" "$f" 2>/dev/null; then final_chars=$(count_chars "$f") final_units=$(estimate_units "$final_chars") final_lines=$(wc -l < "$f") log " ✂️ Truncated: ~${total_units}t ${lines}L → ~${final_units}t ${final_lines}L" ((truncated_count++)) fi ``` ### Technical Analysis For `tail -n N`, output size increases as `N` increases. The algorithm is intended to find the largest number of trailing lines that fits within the c ...[truncated 1843 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: configure.sh:26
Finding: Configuration wizard generates invalid script paths and an incompatible configuration schema
Content: View full analysis
"$CONFIG_FILE" << EOF { "version": "1.0", "maxLines": $MAX_LINES, "frequencyMinutes": $FREQ_MINUTES, "skipActive": $SKIP_ACTIVE, "enableSummaries": $ENABLE_SUMMARIES, "configuredAt": "$(date -Iseconds 2>/dev/null || date '+%Y-%m-%dT%H:%M:%S%z')" } EOF echo "✅ 配置已保存到: $CONFIG_FILE" cat > "$SCRIPTS_DIR/.config" << EOF export MAX_LINES=$MAX_LINES export SKIP_ACTIVE=$SKIP_ACTIVE EOF ``` ```bash TRUNCATE_SCRIPT="$SCRIPTS_DIR/truncate-sessions-safe.sh" echo "" echo " # Session truncation" echo " $CRON_EXPR $TRUNCATE_SCRIPT" if [ "$ENABLE_SUMMARIES" = "true" ]; then SUMMARY_SCRIPT="$SCRIPTS_DIR/generate-daily-summary.sh" echo "" echo " # Daily summary generation" echo " 0 */4 * * * $SUMMARY_SCRIPT" fi ``` The core truncator reads different size fields: ```bash BUDGET_UNITS=$(jq -r '.maxChars // .maxTokens // empty' "$CONFIG_FILE" 2>/dev/null || echo "$BUDGET_UNITS") ``` ### Technical Analysis The Skill documentation states that scripts are installed directly under `~/.openclaw/workspace/skills/context-compression/`. The wizard instead assumes a `scripts/` child directory and does not create it. Because the script uses `set -e`, writing `$SCRIPTS_DIR/.config` can terminate setup if that directory is absent. If setup proceeds in an environment where the directory exists, the displayed cron entries still point to script paths inconsistent with the documented installation layout. The wizard writes `maxLines`, while the core truncator reads `maxChars` or `maxTokens`. The user's selected limit is consequently ignored by the core implementatio ...[truncated 1329 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match

Findings (77)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description says the skill prevents context overflow through automatic session truncation while preserving memory. The code chunk does something materially different: it inspects the latest session file, takes the last 50 lines, extracts recent user messages, detects a few keyword-based categories, and appends them to a daily memory markdown file. There is no logic for truncating sessions, summarizing to reduce context length, pruning history, or otherwise preventing context overflow. Its actual purpose is lightweight memory extraction from recent sessions, not session truncation. It also accesses session files and writes memory/log files despite no declared permissions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared description promises active prevention of context overflow via automatic session truncation and memory preservation. This script does not perform truncation, summarization, preservation, or any automatic remediation. Instead, it inspects session and memory-related files, estimates character usage, prints recommendations, and checks for cron configuration. Its primary behavior is monitoring and reporting, not prevention or automatic maintenance. The cron inspection is also an additional operational capability not reflected in the description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 96% confidence
Finding: The description claims an active prevention mechanism: automatic session truncation and memory preservation. The supplied script does not modify sessions, trim context, preserve memory, or trigger any automatic maintenance. Instead, it only checks session file sizes, estimates usage against a configured limit, optionally outputs JSON, and prints recommendations such as using /compact or editing configuration manually. Its primary purpose is context monitoring/reporting, not automatic overflow prevention. It also inspects local session files and process status, which is a behavior not reflected in the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description focuses on preventing context overflow via session truncation and preserving memory. The code does not manage session size, token/context limits, or truncation of conversation history. Instead, it operates on persistent workspace files, specifically MEMORY.md, to identify and clean expired preference data based on dates and preference type, while writing logs. This is a materially different primary purpose and involves undeclared file modification and scheduled maintenance behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The declared purpose centers on preventing context overflow with automatic session truncation and memory preservation. The code does not manage session context, truncate conversations, or react to overflow conditions. Instead, it is a standalone daily file-processing script that reads today's markdown note from the workspace memory directory, writes a summary file containing essentially the full original content, logs to a logfile, and prunes old summaries. While summarization/memory preservation is loosely related, the implemented behavior is materially different from the stated primary purpose and includes undeclared filesystem access and retention behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 87% confidence
Finding: The declared description suggests a runtime mechanism for managing conversation/session context overflow with automatic truncation and memory preservation. The code does not interact with any session or context buffer. Instead, it is a filesystem-based summarization utility: it reads today's note from a memory directory, extracts headers/tasks/important items/facts, writes a summary file, logs execution, and purges old summaries. While summarization could indirectly support memory preservation, the primary behavior is offline note summarization and file maintenance, not automatic session truncation. Therefore the description materially misrepresents the actual behavior.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The description claims the skill prevents context overflow through automatic session truncation and memory preservation. The code does not truncate sessions, manage context size, or preserve memory automatically. Instead, it reads the latest session JSONL file, searches for importance-related keywords, checks freshness of a daily note in the workspace, logs results, and emits a JSON recommendation such as SAVE_NOW. Its primary function is monitoring and prompting/manual save detection, not overflow prevention or automatic truncation. It also accesses session files, memory-note files, and log files, which is more capability than implied by the empty declared permissions.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The declared description emphasizes preventing context overflow through automatic session truncation and memory preservation. However, the supplied script does not truncate sessions, manage context size, or perform overflow prevention. Its main behavior is an end-of-session audit: it counts extracted facts, checks whether MEMORY.md and a daily note were updated, scans recent session files for possible unsaved important content, writes logs, generates an alert file if issues are found, and invokes a summary-generation script if today's summary is absent. While the summary-generation aspect loosely relates to memory preservation, the primary purpose and implemented capabilities are materially different from the declared description.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 94% confidence
Finding: The declared description emphasizes automatic session truncation and memory preservation to prevent context overflow. The provided code instead acts as a session-start initialization hook for a local memory workspace. It creates missing memory artifacts, daily notes, and fact files; reads recent fact logs into environment variables; and prints/logs a summary. While this loosely relates to memory preservation, the core claimed function—automatic truncation or active context-size management—is absent. This is a material description/behavior mismatch.
Content: No source excerpt is available for this finding.

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.
md
"SKILL.md": "This file"

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · SKILL.md (reported line 93)May include surrounding context.
md
I-assisted**: `identify-facts-enhanced.sh` — calls `openclaw agent --agent main --message` with the trimmed content to semantically identify important facts. Only used when `openclaw` CLI is available on PATH. - **Triggered by**: `truncate-sessions-safe.sh` calls one of these before each truncation cycle ### Preference Lifecycle (`check-preferences-expiry.sh`) - **Scheduling**: Once daily via crontab - **Mechanism**: Reads MEMORY.md preference entries tagged with `@YYYY-MM-DD`, removes expired ones - **Tiers**: Short-term (1-7 days), Mid-term (1-4 weeks), Long-term (permanent) --- ## Scripts | Script | Purpose | Scheduling | |--------|---------|------------| | `truncate-sessions-safe.sh` | Trim session JSONL files | crontab, every 10 min | | `identify-facts.sh` | Keyword-based fact detection | Called by truncate script | | `identify-facts-enhanced.sh` | AI-assisted fact detection | Called by truncate script | | `check-preferences-expiry.sh` | Remove expired preferences | crontab

Intent-Code Divergence

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The documentation contains a direct scope contradiction: one section says the skill only reads/writes under ~/.openclaw/agents/main/, while earlier sections say truncation reads session files under ~/.openclaw/agents/*/sessions/. This can mislead users into granting or trusting broader cross-agent access than they realize, increasing the chance of unintended collection or modification of other agents' session data.
Content: No source excerpt is available for this finding.

Context Leakage

High

Category: Data Exfiltration
Confidence: 95% confidence
Finding: The skill explicitly states that AI-assisted fact identification may send session content to remote LLM services. Because the data source is session history and memory notes, the exfiltrated content could include sensitive prompts, secrets, personal data, or operational details, and unattended cron or automatic invocation can increase the blast radius if enabled.
Content: Scanner excerpt · SKILL.md (reported line 176)May include surrounding context.
md
- **Scope**: Only reads/writes files under `~/.openclaw/agents/main/` and `~/.openclaw/workspace/memory/`. Never touches system files, other agents' data, or other users' data. ### Privacy Notice - **AI-assisted fact identification** (`identify-facts-enhanced.sh`) is **disabled by default**. It invokes the local `openclaw agent` CLI, which may send session content to remote LLM services depending on your OpenClaw configuration. Only enable it if you understand and accept this data flow. To enable, set `"useAiIdentification": true` in the config file. - **Keyword-based identification** (`identify-facts.sh`) is the default and runs entirely locally with no external data transmission. - **Unattended cron execution**: If you enable cron jobs, the scripts run without interactive consent. Review the scripts and test manually before enabling scheduled runs.

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The script’s stated purpose is context compression/session truncation, but its actual behavior is to read recent session JSONL data, extract user messages, classify them, and persist them into daily notes. That mismatch is security-relevant because it expands data retention and creates a covert memory/logging mechanism for user content under a less suspicious description.
Content: No source excerpt is available for this finding.

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · check-context-health.sh (reported line 147)May include surrounding context.
sh
" ⚠️ WARNING: Estimated context exceeds limit!" echo " Recommendations:" echo " 1. Run truncation: truncate-sessions-safe.sh" echo " 2. Reduce L3 summaries: delete older summaries" echo " 3. Compress MEMORY.md" else echo "" echo " ✅ Context within budget" fi echo "" # Check crontab echo "⚙️ System Configuration:" echo "-----------------------" if crontab -l 2>/dev/null | grep -q "truncate-sessions"; then echo " Truncation cron: ✅ Installed" else echo " Truncation cron: ❌ Not installed" echo " Run: crontab -e and add:" echo " */10 * * * * $WORKSPACE/skills/context-compression/truncate-sessions-safe.sh" fi if crontab -l 2>/dev/null | grep -q "generate-daily-summary"; then echo " Summary cron: ✅ Installed" else echo " Summary cron: ⚠️ Not installed (optional)" fi echo "" echo "=== End of Health Check ==="

Self-Modification

High

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill modifies its own code, configuration, or behavior at runtime. Self-modification enables an agent to escalate privileges, disable safety constraints, or install persistent backdoors.
Content: Scanner excerpt · time-decay-truncate.sh (reported line 203)May include surrounding context.
sh
fi done # Phase 5: Replace original file if [ $preserved_count -gt 0 ]; then mv "$temp_result" "$file" log " ✅ Preserved $preserved_count lines (~${kept_units}t), critical: $critical_preserved"

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: The cleanup routine performs rm -f "$SESSIONS_DIR"/*.${pid} using an environment-influenced directory variable. If an attacker can control SESSIONS_DIR or run the script in a hostile environment, they may redirect deletion into unintended locations and cause destructive file removal matching the glob pattern, especially because no path validation constrains the target to an expected sessions root.
Content: Scanner excerpt · truncate-sessions-safe.sh (reported line 26)May include surrounding context.
sh
_CLEANUP_PIDS=() cleanup_on_exit() { for pid in "${_CLEANUP_PIDS[@]}"; do rm -f "$SESSIONS_DIR"/*.${pid} 2>/dev/null || true done flock -u 9 2>/dev/null || true }

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 70% confidence
Finding: Without declared permissions the skill's intent is opaque and cannot be validated.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The manifest description presents the skill as a local context-management utility, but the documentation later admits an AI-assisted mode may send session content to remote LLM services. That scope expansion matters because users may enable the feature without fully appreciating that sensitive session data can leave the local environment.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: The skill instructs the user to install recurring cron jobs that operate on session files and memory stores. This is not inherently malicious, but it does create persistence and unattended execution over sensitive data, which increases risk if the scripts misbehave, are modified later, or invoke optional remote-capable processing.
Content: Scanner excerpt · SKILL.md (reported line 56)May include surrounding context.
md
**Keep conversations within limits. Never lose important context.** > ⚡ **After installing**, run the interactive setup wizard to generate your config file, then add the suggested cron entry with `crontab -e`. See Quick Start below for commands. ## Quick Start

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The script extracts session content and writes derived entries to disk without any user-facing disclosure, consent flow, or warning. Silent persistence of conversational data is dangerous because users may include secrets, personal preferences, or operational details in chat, not expecting them to be copied into separate files for future retention.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: Persisting extracted user messages into daily notes creates a durable secondary store of natural-language data, increasing the chance that sensitive information is retained longer than necessary or exposed through backups, file sharing, or local compromise. In a context-compression skill, this retention is especially risky because it is not essential to the advertised function and may not be expected by users.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The code continuously inspects the latest session file and extracts user messages, which is broader than a narrowly scoped context-management feature. In this skill context, automatic surveillance of session artifacts increases privacy risk because users would reasonably expect compression, not passive harvesting of conversational content into long-lived storage.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The detection rules explicitly preserve messages containing words like 'important,' 'remember,' preferences, decisions, and tasks—exactly the kinds of statements likely to contain sensitive personal, business, or security-relevant details. This creates a predictable path for accidental secret retention because user emphasis is treated as a trigger to store content permanently.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · check-context-health.sh (reported line 147)May include surrounding context.
sh
# Check crontab echo "⚙️ System Configuration:" echo "-----------------------" if crontab -l 2>/dev/null | grep -q "truncate-sessions"; then echo " Truncation cron: ✅ Installed" else echo " Truncation cron: ❌ Not installed"

Static analysis

No suspicious patterns detected.