Context Bridge - No more re-explaining things on model change.

• Outcome: Pass
• Latest audit: May 28, 2026 · 10:02 AM UTC
• Version: 1.0.1

Overview

This is a disclosed local context-memory skill for OpenClaw, with privacy and overwrite caveats but no evidence of hidden exfiltration or malicious behavior.

Install only if you want future OpenClaw sessions to reuse local context. Before running setup.sh, verify the repository source, review the files it will create or overwrite under ~/.openclaw, and avoid placing secrets, credentials, personal data, or untrusted instructions in the handoff or registry files.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs every session to read persistent memory and registry files containing prior actions, installed skills, cron jobs, and agent configurations, but provides no consent, minimization, or sensitivity guidance. This can expose private project history, secrets accidentally stored in memory files, or operational metadata to any new session/model, increasing the risk of unintended data disclosure and prompt-context poisoning.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill instructs users to run a setup process that auto-discovers local skills, agents, and cron jobs and to load multiple persisted context files at session start, but it does not clearly warn that this behavior scans local OpenClaw directories and aggregates potentially sensitive local state. This can expose private project names, agent configurations, schedules, and prior session data to any model that follows the startup protocol, increasing unintended data disclosure risk.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The setup script unconditionally overwrites multiple files under ~/.openclaw using shell redirection, including registries and startup hook content. This can destroy prior configuration or silently replace trusted behavior, and because these files influence future agent/session behavior, the overwrite has security significance beyond mere data loss.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The script creates session-start and manual-load mechanisms that automatically read and display accumulated context from prior sessions, registries, and discovered environment data. In a multi-session or multi-user environment, this establishes a persistence and disclosure channel that can expose sensitive project, agent, cron, or historical context to future model runs without contextual authorization.

Session Persistence

Medium

• Category: Rogue Agent

Content

echo "=== Context Bridge Setup ==="
echo ""

# Create directories
echo "Creating directories..."
mkdir -p ~/.openclaw/model-agnostic-memory
mkdir -p ~/.openclaw/agents/defaults

• Confidence: 86% confidence
• Finding: Creating persistent directories under ~/.openclaw is part of establishing durable cross-session state. By itself mkdir -p is not harmful, but in this skill it is the foundation for storing registries, hooks, and handoff data that survive across sessions and can influence later agent behavior, so the persistence concern is real in context.

Session Persistence

Medium

• Category: Rogue Agent

Content

# CREATE/UPDATE REGISTRY FILES
# ============================================================================

# Create skills-registry.json
echo ""
echo "Creating skills-registry.json..."
cat > ~/.openclaw/skills-registry.json << EOF

• Confidence: 94% confidence
• Finding: Writing skills-registry.json and related files into a persistent home-directory location records durable environment state that later sessions and hooks are instructed to consume. In this script, that persistence is not incidental; it is explicitly used to shape future model behavior, making it a genuine session-persistence risk.

Static analysis

No suspicious patterns detected.