Context Budgeting Pro

• Outcome: Review
• Latest audit: Sep 11, 2026 · 9:11 AM UTC
• Version: 1.0.0

Overview

The skill is broadly about context management, but it can persist session details and claims to run cleanup/compaction that the included script does not actually verify or implement.

Review this skill before installing. It does not show evidence of exfiltration or malware, but it may cause agents to persist session summaries and assume compaction/cleanup happened when the script has not verified that. Use it only after replacing the hard-coded path, clarifying what may be written to memory, and confirming the OpenClaw command performs the intended action.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/gc_and_checkpoint.sh:5
• Finding: Hard-Coded Workspace and Misleading Checkpoint Automation## Vulnerability Details **File Location**: `scripts/gc_and_checkpoint.sh:5-6, 14-17`; related instructions in `SKILL.md:19-27` **Vulnerability Type**: Hard-coded environment path and incomplete security-sensitive automation **Risk Level**: Medium ### Vulnerable Code `scripts/gc_and_checkpoint.sh:5-6, 14-17`: ```bash WORKSPACE="/Users/yang/clawd" HOT_MEMORY="$WORKSPACE/memory/hot/HOT_MEMORY.md" TIMESTAMP=$(date "+%Y-%m-%d %H:%M") echo "🚀 Starting Context Budgeting Service..." # 1. Update Decision Log in HOT_MEMORY.md # Note: This is a placeholder for the agent to fill with actual session context. # When run by the agent, the agent should have already updated the file. # 2. Trigger Physical Compaction via OpenClaw CLI echo "🧹 Triggering session compaction..." # Note: Using the validated 'openclaw' command structure openclaw sessions --active 1 > /dev/null ``` Related mandatory instructions in `SKILL.md:19-27`: ```markdown ### 2. Pre-compression Checkpointing (Mandatory) Before any compaction (manual or automatic), the agent MUST: 1. **Generate Checkpoint**: Update `memory/hot/HOT_MEMORY.md` with: - **Status**: Current task progress. - **Key Decision**: Significant choices made. - **Next Step**: Immediate action required. 2. **Run Automation**: Execute `scripts/gc_and_checkpoint.sh` to trigger the physical cleanup. ## Automation Tool: `gc_and_checkpoint.sh` Located at: `skills/context-budgeting/scripts/gc_and_checkpoint.sh` ``` ### Technical Analysis The skill mandates persistence of session-derived status, decisions, and next steps in a memory file before running the supplied script. However, the script defines an absolute, user-specific workspace path (`/Users/yang/clawd`) rather than deriving the active workspace from validated configuration. This creates an unsafe and non-portable configuration that could refer to another profile or an unintended location if subsequently ...[truncated 2595 chars]
• Remediation: ## Remediation Suggestions 1. Remove the user-specific absolute path. Obtain the workspace from an explicit command-line argument or a trusted OpenClaw configuration API. 2. Canonicalize the selected path and verify that it is contained within the active workspace before reading or writing memory files. 3. Implement the documented checkpoint and compaction behavior with the correct OpenClaw command rather than using a session-listing command. 4. Check all command exit statuses and terminate with a nonzero status when checkpointing or compaction fails. 5. Print a success message only after verifying that the requested operation completed. 6. Restrict checkpoint contents to the minimum information required. Avoid persisting credentials, tokens, raw tool output, personal information, or other sensitive session data. 7. Create checkpoint files with restrictive permissions, such as mode `0600`, and use atomic writes to prevent partial or corrupted state. 8. Document the retention and deletion policy for checkpoint data, including which operation actually removes or compacts it. 9. Add automated tests confirming that the script uses the active workspace, rejects out-of-scope paths, handles command failures, and performs the advertised lifecycle operation.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (3)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 91% confidence
• Finding: The declared description promises a fairly rich context-management capability: partitioning, checkpointing before compression, and lifecycle management for long-running sessions. The supplied code does not implement those behaviors. It sets paths, emits progress messages, runs a single OpenClaw CLI command to list or access active sessions, and mentions HOT_MEMORY.md only in comments. No checkpoint file is written, no partitioning logic exists, and no compaction or lifecycle policy is actually enforced beyond the bare CLI call. The commented-out temp cleanup is inactive. Therefore, the actual behavior is materially narrower and different from the declared purpose.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The description says to use the skill when the session is near its limit, when the agent experiences "memory loss," or when aiming to reduce token costs and latency. These conditions are somewhat subjective and broad, and the file does not provide explicit exclusions or a constrained trigger list, which could cause unintended invocation in ordinary long-running conversations.

Missing User Warnings

Low

• Confidence: 79% confidence
• Finding: This code file executes the external `openclaw` CLI, which is a subprocess operation covered by the missing-warning rule. While there is a generic echo message about triggering compaction, the script does not disclose what `openclaw sessions --active 1` actually does, whether it alters session state, or any potential impact to user data.