Context Manager

• Outcome: Review
• Latest audit: May 29, 2026 · 9:34 PM UTC
• Version: 1.1.0

Overview

The package is not clearly malicious, but it mixes a Context Manager skill with broader knowledge-workflow artifacts that can persist and modify local knowledge-base files.

Install only if you are comfortable with a local knowledge-management tool that writes under your home-directory knowledge stores and may alter notes, indexes, reports, rules, and belief files. Review the package carefully because its documentation and shipped modules mix context-manager and knowledge-workflow identities; use backups and avoid running auto-fix or belief-update functions on sensitive notes without inspecting the changes first.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (71)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence
• Finding: The skill appears to have file read/write capabilities despite declaring no permissions, which breaks least-privilege expectations and prevents users or reviewers from understanding what data the skill can access or modify. In a context-management skill handling personal notes, memories, chats, and decision logs, undeclared file access raises meaningful privacy and integrity risks.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence
• Finding: The documented purpose is personal context management, but the behavior reportedly includes broad knowledge-base mutation, auto-repair, rule extraction, belief-updating, content generation, and publishing actions. This mismatch is dangerous because users may invoke a seemingly reflective/note-taking skill without realizing it can transform stored knowledge, write derived files, or publish artifacts externally.

Intent-Code Divergence

Medium

• Confidence: 89% confidence
• Finding: The review asserts 'least privilege' by limiting access to ~/kb, but the same document explicitly shows outbound AI API usage via ai.complete(...). That means the skill's effective trust boundary includes external network egress and data transfer to a third-party service, so the permission/risk description is incomplete and misleading. In a context-management skill handling personal knowledge and sensitive context, this increases the chance of unreviewed data exfiltration or privacy violations.

Description-Behavior Mismatch

Medium

• Confidence: 94% confidence
• Finding: The function `check_belief_conflict` performs persistent side effects automatically: once a heuristic threshold is met, it appends to the knowledge-base index and rewrites `false-beliefs.md` without an explicit user confirmation or a dry-run step. In a personal-context skill, silently reformulating and persisting a user's beliefs is risky because weak or incorrect heuristics can overwrite sensitive personal knowledge and create unauthorized durable changes.

Description-Behavior Mismatch

Medium

• Confidence: 78% confidence
• Finding: The code automatically creates an outputs directory on initialization and is designed to persist generated content to disk, even though the skill is described as managing personal context. In a personal-context skill, silent local persistence can expose sensitive notes or internal reasoning to unintended access, especially on shared systems or synced folders.

Description-Behavior Mismatch

Medium

• Confidence: 93% confidence
• Finding: The function persistently writes user content, rewrites note files, and updates shared index/log state on the local filesystem, which is broader than a simple transient 'context management' action. In an agent setting, undisclosed persistent storage and mutation of user data can create privacy, integrity, and scope-creep risks, especially if the user did not explicitly consent to file creation and note rewriting.

Context-Inappropriate Capability

Low

• Confidence: 80% confidence
• Finding: The link-suggestion logic scans previously stored notes and keyword indexes to infer relationships across the broader knowledge base, not just the current note. While this appears intended for knowledge management, it expands data processing scope and can expose or surface sensitive prior notes through automatic association without clear user awareness.

Description-Behavior Mismatch

Medium

• Confidence: 81% confidence
• Finding: The module is presented as a lint/checking component, but it also writes reports, may overwrite the index, and can trigger note edits through auto-fix. In a context-management skill handling personal knowledge data, silent mutation of user files expands the trust boundary and can cause integrity loss or unexpected persistent changes.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The auto-fix routine appends content directly into user notes, which goes beyond passive organization and can alter personal records without granular consent. In this skill context, user notes are likely sensitive and semantically important, so even small automatic edits can damage trust, provenance, or downstream workflows.

Intent-Code Divergence

Medium

• Confidence: 87% confidence
• Finding: The document claims the skill uses least privilege, yet it explicitly describes publishing to ClawHub and pushing to GitHub, which are outbound network and release operations outside a minimal-permission context manager scope. This mismatch can mislead reviewers and users about the skill's operational reach, reducing scrutiny around capabilities that could exfiltrate data or alter external systems.

Intent-Code Divergence

High

• Confidence: 98% confidence
• Finding: The file is for a skill named 'context-manager' but the content repeatedly describes a different skill, 'knowledge-workflow', including release identifiers, install commands, and usage examples. This object/intent mismatch is dangerous because it can mask unauthorized functionality, confuse reviewers about what code or behavior is actually being shipped, and enable supply-chain style misdirection where one artifact is presented as another.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The release notes describe and operationalize a substantially different skill, 'knowledge-workflow', than the declared 'context-manager' purpose. This capability mismatch is dangerous because users, reviewers, or automated tooling may authorize a seemingly narrow personal-context skill while actually receiving a broader workflow that ingests documents, stores data, generates outputs, and performs learning and repair actions, increasing the chance of overprivileged or unexpected behavior.

Description-Behavior Mismatch

Medium

• Confidence: 97% confidence
• Finding: The release notes describe a different skill identity and scope ('knowledge-workflow') than the declared skill ('context-manager'), which is a supply-chain trust and transparency problem. This mismatch can mislead users and reviewers about what is being installed or invoked, increasing the chance that broader data-processing behavior is accepted under a narrower personal-context-management label.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The documented capabilities extend into external content collection and automated content generation, which materially exceed the stated purpose of personal context management. That scope expansion is dangerous because users may grant access or provide sensitive tokens expecting local note management, while the skill actually supports ingestion, storage, and downstream transformation of third-party content.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: Repeatedly referring to the skill as 'knowledge-workflow' while the manifest says 'context-manager' creates direct identity confusion. In skill ecosystems, identity inconsistency undermines provenance checks, review quality, and user consent, making it easier for a package to masquerade as a different, more trusted, or narrower tool.

Description-Behavior Mismatch

High

• Confidence: 98% confidence
• Finding: The file documents and promotes a substantially different skill ('knowledge-workflow') than the declared 'context-manager' skill, including broader collection, storage, output generation, and self-evolution behaviors. This mismatch is dangerous because users, reviewers, or downstream tooling may grant permissions or trust based on the manifest while the packaged content encourages materially different operations.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The documented ability to collect from Feishu, WeChat Reading, URLs, and arbitrary text exceeds the narrow personal-context-management description and introduces ingestion of external potentially sensitive content. In this skill context, that expansion increases risk because users may not expect broad data acquisition or the privacy implications of importing third-party content into persistent knowledge stores.

Context-Inappropriate Capability

Medium

• Confidence: 85% confidence
• Finding: Generating articles, weekly reports, and monthly reports goes beyond simple context management and can transform stored personal or imported information into broader derivative outputs. That is risky because it increases the chance of sensitive information propagation, accidental disclosure, or misuse beyond the user’s original intent.

Context-Inappropriate Capability

Medium

• Confidence: 90% confidence
• Finding: Belief updating and self-repair imply autonomous modification of internal rules, stored knowledge, or behavior beyond passive context management. In this context, such self-modifying features are dangerous because they can alter user data or system behavior in ways that are opaque, hard to audit, and inconsistent with the advertised role of the skill.

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The documentation explicitly brands the package as 'knowledge-workflow v2.0', directly contradicting the declared identity of 'context-manager'. Identity inconsistency is a supply-chain and trust problem: it can conceal the real scope of the skill, mislead reviewers, and enable capability smuggling under a less suspicious manifest name.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The report claims all core modules are implemented and fully tested, but earlier sections explicitly state that key functions such as recall search, map generation, and parts of review logic are still placeholders or unimplemented. This is a genuine integrity issue because it can mislead reviewers, deployers, or users into trusting a capability that does not actually exist, increasing the risk of unsafe release decisions and mishandling of sensitive context data.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The module summary marks recall and review as passed, but the detailed test results say the search logic and actual review logic still need implementation. In a context-management skill, overstating readiness is dangerous because users may rely on incomplete recall/review behavior for personal memory, decision support, or sensitive information management.

Description-Behavior Mismatch

Medium

• Confidence: 95% confidence
• Finding: The test report describes a broader 'knowledge-workflow' capability set—collecting from external sources, tagging, storing, evolving, and generating output—while the manifest frames the skill as personal context management and cognitive mapping. This mismatch weakens user trust boundaries and can hide materially different data-handling behavior from users and reviewers.

Context-Inappropriate Capability

Medium

• Confidence: 88% confidence
• Finding: The document indicates the skill can ingest content from external sources and generate a public-facing article draft, which goes beyond narrow personal context management. That broader capability increases risk of unintended data exfiltration, copyright misuse, or transformation of private notes into publishable content without sufficiently explicit disclosure or consent boundaries.

Intent-Code Divergence

High

• Confidence: 97% confidence
• Finding: The report claims successful recognition/support for feishu, wechat, url, and text, but elsewhere admits that Feishu API integration, WeChat parsing, and URL fetching are not actually implemented. This contradiction is a serious integrity issue because it can mislead reviewers and users about what has been tested and what data-access behaviors are real, masking unimplemented or stubbed code paths.

VirusTotal

67/67 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.