Security audit

OpenClaw: compact improver

Security checks for vulnerabilities and agentic risk

Overview

This prompt-only skill is not malicious, but it asks users to persist broad conversation summaries with full messages, paths, and code without privacy redaction.

Review carefully before installing. Prefer using the manual per-/compact prompt rather than a global systemPrompt or hook change, and add explicit rules to omit or mask secrets, tokens, credentials, personal data, private URLs, and proprietary code unless truly necessary.

SkillSpector

Vulnerability Patterns

Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Vague Triggers

Medium

Confidence: 85% confidence
Finding: The trigger condition is broad enough that the skill may activate for loosely related complaints about summaries or context loss, causing it to intervene outside a narrowly intended scope. Over-broad activation increases the chance that the skill’s aggressive structured summarization behavior is applied to conversations containing sensitive content, which can amplify downstream data exposure risks.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The template explicitly requires preserving all user messages and complete runnable code snippets in the compacted summary, but provides no instruction to filter secrets, credentials, personal data, or sensitive operational details. In a summarization context, this creates a durable secondary copy of potentially sensitive content and increases the chance that private data is surfaced later to the model or user when the summary is reused.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The prescribed summary format explicitly tells the model to retain and restate all user messages, exact file paths, line numbers, current work details, and runnable code snippets. In a compaction context, this can preserve or re-surface secrets, private prompts, proprietary code, credentials in paths or snippets, and other sensitive context that a safer summary would abstract or redact.

Ssd 3

Medium

Confidence: 97% confidence
Finding: Requiring all user messages to be reproduced verbatim in the summary creates a direct natural-language data leakage path. Any secrets, personal data, confidential instructions, or sensitive context a user previously entered would be retained and potentially exposed in later compact outputs, even when such detail is unnecessary for task continuity.

Ssd 3

Medium

Confidence: 96% confidence
Finding: The instruction to preserve all file paths and include complete runnable code can expose internal repository structure, proprietary source code, secrets embedded in code, and environment-specific paths. Because compact summaries may persist and be reused across later interactions, this can amplify disclosure of sensitive implementation details beyond the original context.

Static analysis

No suspicious patterns detected.