context-manager

• Outcome: Review
• Latest audit: Sep 14, 2026 · 10:34 PM UTC
• Version: 1.0.1

Overview

This skill is a local memory manager, but it stores potentially sensitive memories in a predictable plaintext database and handles memory text in ways users may not expect.

Install only if you are comfortable with memories being stored locally in plaintext at a predictable ~/.openclaw path. Do not store passwords, tokens, private conversations, or business-sensitive data in it, and expect some documented features to be unavailable unless the implementation is expanded.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/context-manager.py:135

Finding

Sensitive memory content exposed through command-line arguments and terminal output

Content

View full analysis

Vulnerability Details

File Location: scripts/context-manager.py, lines 135-150
Vulnerability Type: Sensitive-data exposure through process arguments, shell history, and output
Risk Level: Medium

Vulnerable Code

python

parser = argparse.ArgumentParser(description='智能上下文管理系统')
parser.add_argument('--init', action='store_true', help='初始化系统')
parser.add_argument('--add', type=str, help='添加记忆')
parser.add_argument('--importance', type=float, default=1.0, help='记忆重要性')
parser.add_argument('--stats', action='store_true', help='显示统计信息')
parser.add_argument('--auto-manage', action='store_true', help='自动管理')
parser.add_argument('--model', type=str, default='kiro/claude-haiku-4-5', help='指定模型')

args = parser.parse_args()

manager = ContextManager()

if args.init:
    print("✅ 系统已初始化")
    print(f"📁 数据库位置: {manager.db_path}")

elif args.add:
    manager.add_memory(args.add, args.importance)
    print(f"✅ 已添加记忆: {args.add[:50]}...")

The documented invocation also encourages direct placement of memory content in a command-line argument:

bash

python3 scripts/context-manager.py --add "你的记忆内容" --importance 0.9

Technical Analysis

The --add option accepts potentially sensitive memory content directly through the process command line. Depending on the operating system and its configuration, command-line arguments can be exposed through:

• Shell history files.
• Process inspection utilities and process metadata.
• Job-control or process-monitoring services.
• Audit logs, command wrappers, or orchestration logs.
• Terminal session recording.

After the memory is stored, the program also prints its first 50 characters. This can copy sensitive content into terminal logs, CI logs, chatbot execution transcripts, or monitoring systems.

This exposure is unnecessary for the declared memory-management functionality. The program only needs the content internally and does not ...[truncated 1369 chars]

Remediation

View remediation

Remediation Suggestions

1. Accept sensitive memory content through standard input rather than a command-line argument, for example:

   python

   import sys
   
   if args.add_stdin:
       content = sys.stdin.read()
       manager.add_memory(content, args.importance)
   

2. Provide an interactive input mode. If the content is expected to be secret and single-line, use getpass.getpass() to prevent terminal echo.

3. If file-based input is supported, require an explicit protected input file and validate that it is a regular file with appropriately restrictive permissions.

4. Do not print any portion of the submitted content. Return only a non-sensitive confirmation, such as the new memory identifier.

5. Deprecate or prominently warn about --add VALUE because command-line arguments cannot reliably be kept secret.

6. Update README.md and SKILL.md so examples use stdin or another protected input mechanism.

7. Avoid logging raw memory content and add tests confirming that secrets are absent from standard output and error messages.

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/context-manager.py:27

Finding

Plaintext memories stored in a predictable hard-coded cross-workspace database

Content

View full analysis

Vulnerability Details

File Location: scripts/context-manager.py, lines 27-33 and 79-94
Vulnerability Type: Insecure local storage and insufficient workspace isolation
Risk Level: Medium

Vulnerable Code

The storage location is hard-coded to a Telegram bot workspace:

python

def __init__(self, workspace_dir=None):
    if workspace_dir is None:
        workspace_dir = Path.home() / '.openclaw' / 'workspace-telegram-bot1'

    self.workspace_dir = Path(workspace_dir)
    self.memory_dir = self.workspace_dir / 'memory'
    self.db_path = self.memory_dir / 'memories.db'
    self.memory_dir.mkdir(parents=True, exist_ok=True)
    self.init_database()

Memory content is inserted directly into the unencrypted SQLite database:

python

def add_memory(self, content, importance=1.0, tags=''):
    """添加记忆"""
    conn = sqlite3.connect(self.db_path)
    cursor = conn.cursor()

    tokens = self.estimate_tokens(content)
    layer = 'hot' if importance > 0.8 else 'warm'

    cursor.execute('''
        INSERT INTO memories (content, importance, layer, tokens)
        VALUES (?, ?, ?, ?)
    ''', (content, importance, layer, tokens))

    conn.commit()
    conn.close()

    return True

Technical Analysis

The application stores arbitrary memory content as plaintext in a predictable database at:

text

~/.openclaw/workspace-telegram-bot1/memory/memories.db

Although the constructor technically accepts workspace_dir, the command-line interface always calls ContextManager() without exposing a workspace-selection option. Consequently, every CLI invocation under the same account uses the same Telegram-bot-specific database.

The implementation does not explicitly enforce owner-only permissions for either the directory or database. Effective permissions therefore depend on the host's existing directories and umask. It also provides no per-user or per-agent log ...[truncated 1672 chars]

Remediation

View remediation

Remediation Suggestions

1. Use a dedicated, skill-specific data directory rather than a hard-coded Telegram bot workspace.

2. Add an explicit CLI option or configuration setting for the workspace and validate the resulting path.

3. Separate databases by agent, user, or tenant where multiple principals can invoke the skill.

4. Create the data directory with owner-only permissions and verify existing permissions before use:

   python

   self.memory_dir.mkdir(parents=True, exist_ok=True, mode=0o700)
   self.memory_dir.chmod(0o700)
   

5. Create or harden the database file with mode 0600. Handle file creation carefully to avoid a permissive window and reject symbolic links or unexpected non-regular files.

6. Offer encryption at rest for sensitive memories, with keys obtained from an operating-system key store or another dedicated secret-management mechanism rather than hard-coded in the project.

7. Document the local storage location, plaintext-storage behavior, access model, retention policy, and recommended prohibition against storing credentials.

8. Add integrity-protected backups and a recovery strategy if stored memories are operationally important.

9. Consider refusing to open a database whose ownership or permissions do not match the expected security policy.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (7)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The README advertises persistent SQLite storage and commands that add and automatically manage memory, but it does not warn users that data will be retained or potentially modified. In a context-management skill, this omission can cause users to store sensitive conversation data without informed consent, increasing privacy and integrity risk even if the file itself contains no executable exploit.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 88% confidence

Finding

The description and operational guidance are written in Chinese throughout the file, which effectively forces a specific language for users without any opt-in or stated regional justification. The policy requires either a user language choice or a clearly documented locale constraint.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The documentation exposes destructive operations such as delete and reset without any adjacent warning, confirmation requirement, backup guidance, or explanation of irreversible data loss. In a context-management skill backed by SQLite memory storage, users may execute these commands and permanently erase memory/context data unintentionally, making the omission a genuine safety issue even though it is not overtly malicious.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest and module docstring describe a broader 'intelligent context management system' with multi-model adaptation, layered memory, and dynamic injection. In practice, the implementation creates a SQLite database, adds memory rows, returns aggregate stats, and 'auto_manage' only calculates token usage and returns a fixed 'optimized' status, so the advertised capabilities are materially overstated.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

This code presents its description, docstrings, CLI help, and output messages in Chinese only, which imposes a specific language on users. The file does not offer any language selection or indicate that the tool is intended only for a Chinese-speaking or region-specific environment.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The function name and docstring '自动管理上下文' imply that it will take management actions on stored context. However, the code only calculates usage statistics and returns them, with no pruning, re-layering, compression, indexing, or injection behavior, which directly contradicts the documented intent.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

A language or locale policy violation applies when a skill effectively forces a specific language without user opt-in. This file presents all user-facing instructions in Chinese and does not indicate that the skill is region-specific or provide an alternative language option.

Content

No source excerpt is available for this finding.