Openclaw Context Capsule

• Outcome: Review
• Latest audit: Sep 16, 2026 · 9:11 AM UTC
• Version: 1.6.1

Overview

This skill is a coherent local context-compression plugin with disclosed limits and no evidence of hidden exfiltration, persistence, or unsafe install behavior.

Install this only if you want older session history summarized into future model context. Do not use it as your only privacy control for highly sensitive chats, because semantic personal or confidential details may still be retained even when credential-shaped secrets are redacted.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• System Prompt Leakage: Direct Leakage, Indirect Extraction, Tool-Based Exfiltration

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The declared description overstates several safety-oriented behaviors that are not supported by the supplied code chunk. The type definitions and comments clearly support bounded extractive summarization, compressed audit storage, deterministic hashing, and tracking of superseded/abandoned subjects. However, nothing in the exposed interfaces or comments indicates explicit secret redaction or quarantine/isolation of injected instructions. Likewise, 'keeps recent messages verbatim' is not represented in the capsule schema or API, which only returns extracted facts/topics plus compressed history and an injection string. The primary purpose is broadly aligned—local deterministic session-history compression into a bounded capsule—but important claimed capabilities are missing, so this is a description/behavior mismatch.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 89% confidence

Finding

The core declared purpose mostly matches: the plugin does local history compression, keeps recent messages verbatim, and performs best-effort secret redaction without network or filesystem access. However, the description claims stronger safety/behavioral features than the code demonstrates. In this chunk, there is no explicit logic to detect or quarantine prompt-injection/injected instructions; the capsule is simply generated from normalized older messages and inserted into the system prompt addition. Likewise, 'lane-change-aware' and 'flags abandoned directions' are not substantively implemented here beyond a final instruction string saying superseded items should not be acted on, and possibly behavior hidden inside the imported compression module, which is not shown. The code also delegates compaction to the OpenClaw runtime, which is an extra operational behavior not mentioned in the declared purpose, though it is related rather than unrelated. Overall, this is a description-behavior mismatch because important claimed capabilities around injected-instruction quarantine and lane-change awareness are not supported by the supplied code chunk.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The declared description is for a higher-level context-summarization and safety-processing skill. The supplied code chunk does not implement that behavior; it only exposes generic platform utilities such as SHA-256 hashing, byte operations, and string deflate compression. While compression could be a supporting detail, the core advertised capabilities—keeping recent messages verbatim, flagging abandoned directions, quarantining injected instructions, and redacting secrets—are not present in this chunk. The code therefore does not accurately represent the declared purpose.

Content

No source excerpt is available for this finding.

YARA rule 'agent_skill_prompt_injection_hidden_instructions': Prompt injection or hidden instructions embedded in AI agent skill text [agent_skills]

High

• Category: YARA Match
• Confidence: 80% confidence

Finding

YARA rule matched a hack tool or exploit indicator (offensive tools, reconnaissance, privilege escalation, or exploit frameworks).

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: context-capsule
description: Compresses older OpenClaw agent session history into a bounded, lane-change-aware context capsule — keeps recent messages verbatim, flags abandoned directions, quarantines injected instructions, and redacts secrets. Local, deterministic, any model.
license: MIT
metadata:
  author: Parad0x-Labs
---

# Context Capsule

Compress older agent session history before it hits the LLM, so long chats stop
re-sending the full transcript every turn. It keeps the recent tail verbatim and
turns older history into a bounded extractive capsule with decisions, tasks,
errors, paths, links, questions, and durable facts. Works with any model —
Claude, GPT, Ollama, Mistral, LM Studio.

**What sets it apart:**

- **Lane-change aware.** When the session pivots ("replace X with Y", "forget X,
  use Y instead"), the capsule marks the abandoned direction

Instruction Override

High

• Category: Prompt Injection
• Confidence: 80% confidence

Finding

This pattern attempts to override system instructions or ignore safety constraints. Without LLM analysis, manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

>   without ever exposing its value. Best-effort pattern matching — strong, not a
>   guarantee for the most sensitive chats.
> - **Injection quarantine** — instruction-injection patterns in older history
>   ("ignore previous instructions", "you are now…", "reveal your prompt") are
>   wrapped as inert untrusted text, never surfaced as a live instruction.
> - **Bounded work** — every extraction pass runs on size-capped input, so a
>   megabyte message or an adversarial string finishes in milliseconds instead of

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · SKILL.md (reported line 54)May include surrounding context.

md

>   without ever exposing its value. Best-effort pattern matching — strong, not a
>   guarantee for the most sensitive chats.
> - **Injection quarantine** — instruction-injection patterns in older history
>   ("ignore previous instructions", "you are now…", "reveal your prompt") are
>   wrapped as inert untrusted text, never surfaced as a live instruction.
> - **Bounded work** — every extraction pass runs on size-capped input, so a
>   megabyte message or an adversarial string finishes in milliseconds instead of

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · dist/compression.js (reported line 267)May include surrounding context.

js

{ re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g, type: "GITHUB_PAT" },
    // GitHub classic tokens (ghp_/gho_/ghu_/ghs_/ghr_).
    { re: /\bgh[pousr]_[A-Za-z0-9_]{20,}/g, type: "GITHUB_TOKEN" },
    // GitLab personal access tokens. The "glpat-" prefix is GitLab-specific, so a
    // short floor is safe (no legitimate token starts glpat-) and catches truncated
    // or non-canonical-length values too.
    { re: /\bglpat-[A-Za-z0-9_-]{8,}/g, type: "GITLAB_TOKEN" },

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · dist/compression.js (reported line 271)May include surrounding context.

js

{ re: /\bgithub_pat_[A-Za-z0-9_]{20,}/g, type: "GITHUB_PAT" },
    // GitHub classic tokens (ghp_/gho_/ghu_/ghs_/ghr_).
    { re: /\bgh[pousr]_[A-Za-z0-9_]{20,}/g, type: "GITHUB_TOKEN" },
    // GitLab personal access tokens. The "glpat-" prefix is GitLab-specific, so a
    // short floor is safe (no legitimate token starts glpat-) and catches truncated
    // or non-canonical-length values too.
    { re: /\bglpat-[A-Za-z0-9_-]{8,}/g, type: "GITLAB_TOKEN" },

Direct Prompt Extraction

High

• Category: System Prompt Leakage
• Confidence: 85% confidence

Finding

Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.

Content

Scanner excerpt · dist/compression.js (reported line 309)May include surrounding context.

js

if (rule.build) {
                // If the build target secret is allowlisted, redact() returns it raw,
                // so the whole match is reconstructed unchanged.
                return rule.build(groups, redact);
            }
            const full = groups[0];
            return isAllowlisted(full) ? full : redactTag(rule.type, full);

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 77% confidence

Finding

The module is designed to retain and later inject selected content from older session history, including 'durable facts' and user-provided material. Even though explicit secrets are scrubbed, this natural-language design still directs the system to remember and restate potentially sensitive user data across turns, which is a semantic data-leak risk rather than a literal exfiltration call.

Content

No source excerpt is available for this finding.

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 35)May include surrounding context.

json

}
  },
  "devDependencies": {
    "@noble/hashes": "^2.2.0",
    "@types/node": "^22.0.0",
    "pako": "^2.1.0",
    "typescript": "^5.6.0"

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 36)May include surrounding context.

json

},
  "devDependencies": {
    "@noble/hashes": "^2.2.0",
    "@types/node": "^22.0.0",
    "pako": "^2.1.0",
    "typescript": "^5.6.0"
  },

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 37)May include surrounding context.

json

"devDependencies": {
    "@noble/hashes": "^2.2.0",
    "@types/node": "^22.0.0",
    "pako": "^2.1.0",
    "typescript": "^5.6.0"
  },
  "scripts": {

Unpinned Dependencies

Low

• Category: Supply Chain
• Confidence: 40% confidence

Finding

Dependencies lack version pinning, allowing potential malicious package updates. Consider pinning versions.

Content

Scanner excerpt · package.json (reported line 38)May include surrounding context.

json

"@noble/hashes": "^2.2.0",
    "@types/node": "^22.0.0",
    "pako": "^2.1.0",
    "typescript": "^5.6.0"
  },
  "scripts": {
    "build": "tsc -p tsconfig.json",

Static analysis

Detected: suspicious.prompt_injection_instructions

Prompt-injection style instruction pattern detected.

Warn

• Code: suspicious.prompt_injection_instructions
• Location: SKILL.md:54