Smart Context Manager

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:37 AM UTC
• Version: 1.0.3

Overview

This skill can help manage OpenClaw context, but its replace mode can store, delete, and move session history in ways users should review carefully.

Install only if you are comfortable with a local script reading OpenClaw session history, saving plaintext summaries/backups, and in --replace mode deleting live session files. Avoid using --replace on Slack, cron, group, or sensitive sessions unless the destination behavior is fixed or manually verified, and review generated summaries for secrets before reuse.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: compress.sh:744

Finding

Selected Session Context Is Injected into the Fixed Main Session

Content

View full analysis

/dev/null) ``` ```bash if $do_replace; then echo "" echo -e "${YELLOW}🔄 Resetting session and injecting compressed context...${NC}" local old_session_id="$SESSION_ID" local state_dir="${OPENCLAW_STATE_DIR:-$HOME/.openclaw}" local jsonl_file="$state_dir/agents/$AGENT_ID/sessions/$SESSION_ID.jsonl" # Backup the JSONL file before deleting if [[ -f "$jsonl_file" ]]; then local backup_file="$COMPRESSED_DIR/$timestamp.session-backup.jsonl" echo " Backing up session file..." cp "$jsonl_file" "$backup_file" echo " Backup saved: $backup_file" # Delete the JSONL to reset the session (official method per docs) echo " Deleting session JSONL to reset..." rm "$jsonl_file" else echo -e "${YELLOW} Warning: Session file not found, skipping backup${NC}" fi # Wait a moment for the system to recognize the deletion sleep 1 # Inject the summary - this will create a fresh session local context_msg="[COMPRESSED CONTEXT - Session was compressed on $(date -Iseconds)] The following is a summary of the previous conversation. Use this to continue the work: --- $summary_text --- Please acknowledge that you have received this compressed context and are ready to continue." echo " Injecting compressed context into fresh session..." local inject_response inject_response=$(openclaw agent --to main -m "$context_msg" --json 2>/dev/null) ``` ### Technical Analysis The script allows the operator to select a session by key or ID. It correctly sends the summarization request to the selected session through `--session-id "$SE ...[truncated 2304 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: compress.sh:769

Finding

Sensitive Session Transcripts and Backups Are Stored without Enforced Access Controls

Content

View full analysis

"$transcript_file" </dev/null || date) ## Session Statistics - Context Usage: $((CURRENT_TOKENS * 100 / MAX_TOKENS))% - Current Tokens: $CURRENT_TOKENS - Max Tokens: $MAX_TOKENS - Threshold: ${THRESHOLD}% - Compression Depth: ${DEPTH} ## Transcript EOF # Read and parse JSONL transcript file if [[ -f "$SESSION_FILE" ]]; then echo " Reading session file..." # Skip first line (metadata), process rest as messages tail -n +2 "$SESSION_FILE" | while IFS= read -r line; do # Extract role and content from each message local role=$(echo "$line" | jq -r '.message.role // "unknown"' 2>/dev/null) local content=$(echo "$line" | jq -r '.message.content[]?.text // empty' 2>/dev/null | tr '\n' ' ') if [[ -n "$content" ]]; then echo "$role: $content" >> "$transcript_file" fi done ``` ```bash # Save the summary local timestamp timestamp=$(date +%Y%m%d-%H%M%S) local summary_file="$COMPRESSED_DIR/$timestamp.ai-summary.md" cat > "$summary_file" </dev/null || date) Model: $SESSION_MODEL --- $summary_text EOF ``` ```bash # Backup the JSONL file before deleting if [[ -f "$jsonl_file" ]]; then local backup_file="$COMPRESSED_DIR/$timestamp.session-backup.jsonl" echo " Backing up session file..." cp "$jsonl_file" "$backup_file" echo " Backup saved: $backup_file" ``` ### Technical Analysis The Skill writes extracted transcripts, AI ...[truncated 2024 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (15)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The documented behavior goes well beyond simple 'context management': it reads and backs up full session transcripts, deletes session files, reinjects summarized context, and may pull repository state. That mismatch matters because users may invoke it expecting a safe summarization utility, while it actually performs destructive and sensitive data handling operations that can expose or alter local session state.

Content

No source excerpt is available for this finding.

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 75% confidence

Finding

Tool calls are chained to bypass individual safety checks or escalate capabilities beyond what any single tool call would allow.

Content

Scanner excerpt · compress.sh (reported line 45)May include surrounding context.

sh

cleanup() {
    if [[ ${#TEMP_FILES[@]} -gt 0 ]]; then
        for f in "${TEMP_FILES[@]}"; do
            [[ -f "$f" ]] && rm -f "$f"
        done
    fi
}

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The --replace flow exceeds passive context management by destructively resetting session state: it backs up, deletes the live session JSONL, and then recreates state by injecting a summary into a fresh session. That can cause loss of original conversation history, break forensic/audit continuity, and silently alter the session lifecycle in ways users may not expect from a summarization feature.

Content

No source excerpt is available for this finding.

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The --replace mode performs a destructive reset by deleting the session file, yet neither the help text nor the command path requires a confirmation prompt or strongly worded warning. Users invoking summarization may accidentally destroy active state with no clear chance to abort.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script directly deletes OpenClaw session files with rm, which is a destructive operation against primary application state. If run on the wrong session or in automation, it can irreversibly remove conversation history and undermine integrity guarantees of the session store.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

Having the agent summarize its full own context and preserve 'important context' can easily capture secrets, personal data, tokens, internal prompts, or other sensitive user-supplied material. Because the summary is then saved to disk and optionally reinjected into a fresh session, the skill increases persistence and spread of sensitive data beyond the original conversation boundary.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The prompt explicitly asks for 'important context' and pending work to remember, which strongly encourages retention of user-provided details that may be sensitive. In this skill's context, that retained information is not just transient model output: it is written to files and used to seed new sessions, creating durable exposure and possible prompt contamination.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The top-level documentation describes the tool as manual summary generation, monitoring, and transcript extraction, but a later code path performs session reset by deleting backing files and reinjecting context. This mismatch increases risk because operators may grant trust or automate the tool under a false assumption about its scope and side effects.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 75% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · compress.sh (reported line 370)May include surrounding context.

sh

git log --oneline -10 2>/dev/null >> "$output" || echo "  No git history" >> "$output"
    
    echo -e "\n## Continuation Notes" >> "$output"
    echo "This summary was automatically generated to preserve context across session handoff." >> "$output"
    echo "For full details, see: $COMPRESSED_DIR/$session_id.transcript.md" >> "$output"
}

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

Persisting full conversation transcripts and summaries specifically for later reuse creates a durable store of whatever sensitive data appeared in the session. Because the content is extracted from broad conversational context rather than a narrowly scoped artifact, the resulting files are likely to include more sensitive information than necessary.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script writes full transcripts and summaries of conversations to local disk for later reuse without any warning, consent step, retention policy, or permission hardening. These artifacts can contain secrets, credentials, personal data, or proprietary content and may be readable by other local users or later exfiltrated.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The AI summarization flow submits the existing session context to the agent to produce a summary, but the tool does not present an explicit privacy notice or data-handling warning. Even if the agent is local or trusted, this broad processing of prior conversation content can expose sensitive material beyond what users expect from a simple context utility.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The summarization prompt explicitly asks for 'important context' and then stores that result for reuse, encouraging broad retention of sensitive details that may not be required to continue work. This increases the chance that credentials, internal architecture notes, or personal data are condensed into a durable summary artifact.

Content

No source excerpt is available for this finding.

Unrestricted Tool Access

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill grants unrestricted tool access without appropriate constraints. An agent with unfettered tool access can perform arbitrary actions including file modification, network requests, and code execution.

Content

Scanner excerpt · compress.sh (reported line 739)May include surrounding context.

sh

4. **Pending tasks** - What still needs to be done
5. **Important context** - Any critical information to remember

Format this as a clear, structured summary that could be used to continue this work in a new session. Do NOT use any tools, just write the summary.'
    
    # Call the agent with the summarization prompt
    # Note: redirect stderr to /dev/null to avoid Node deprecation warnings breaking JSON

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The replacement flow reinjects prior-session summary text into a fresh session, propagating any sensitive information captured in the summary into new active context. This duplicates sensitive data across artifacts and sessions, widening exposure and complicating later deletion or minimization.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.