T01 · Skill Instruction Hijacking
Error
- Location
lib/index.js:928- Finding
Cross-role semantic compaction elevates user-controlled content to system authority
- Content
View full analysis
- Remediation
View remediation
Security audit
qui-context-optimizer
Security checks for vulnerabilities and agentic risk
Overview
This skill is a coherent context-pruning tool, but it stores conversation content and can reinsert user-derived material as system-level context, which needs careful review before installation.
Install only if you are comfortable with local retention of conversation content and review the code first. Disable archive storage and chat/content logging unless explicitly needed, avoid storing secrets in conversations processed by this skill, and do not allow retrieved or compacted user content to be passed to an LLM as system instructions without modification.
Vulnerability Patterns
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T02 · Agent Memory Poisoning
Error
- Location
lib/index.js:1512- Finding
Persistent archived user content is automatically restored as system instructions
- Content
View full analysis
({ role: 'system', content: `[Archived Context]: ${snippet}`, priority: 7, // High priority for retrieved context fromArchive: true, archiveRelevance: archiveResult.relevanceScores?.[index] || 0.5, })); // Combine archive messages with current messages const combinedMessages = [...archiveMessages, ...messages]; ``` The archive-storage path persists removed message content without enforcing its original trust level during later retrieval: ```javascript async storeRemovedInArchive(removedMessages, strategy) { if (!this.archive || removedMessages.length === 0) return; for (const removed of removedMessages) { const { message, reason, ...context } = removed; // Prepare metadata for archive const metadata = { role: message.role, priority: message.priority || 5, tokens: this.countTokens(message.content), compactedAt: Date.now(), compactionReason: reason, compactionStrategy: strategy, compactionContext: context, category: this.determineCategory(message.content), }; // Store in archive try { await this.archive.store(message.content, metadata); this.stats.archiveStores++; } catch (error) { console.warn('Failed to store message in archive:', error.message); } } } ``` ### Technical Analysis Removed conversation messages are persisted in the archive with their original content. Although the original role is recorded in metadata, smart retrieval does not use that role to enforce a trust boundary. Instead, every selected snippet is converted into a new system message. The ...[truncated 1822 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
lib/index.js:137- Finding
Conversation content is archived and logged in plaintext by default
- Content
View full analysis
80 ? '...' : ''}"`); console.log(`[Archive] Metadata: ${tokens} tokens, category: ${category}, priority: ${priority}`); const entry = { id: entryId, content, metadata: { ...metadata, timestamp: Date.now(), tokens, priority, category, }, embedding: null, keywords: this.extractKeywords(content), }; // Generate embedding if available if (this.embedder && this.config.archiveIndexing) { try { console.log(`[Archive] Generating embedding for entry`); entry.embedding = await this.embed(content); } catch (error) { console.warn('[Archive] Failed to generate embedding for archive entry:', error.message); } } // Save entry to file await fs.writeFile(entryPath, JSON.stringify(entry, null, 2)); ``` ### Technical Analysis The optimizer processes full conversation messages, which may contain credentials, personal information, proprietary source code, internal prompts, or confidential business data. When messages are removed during compaction, their complete content is written to plaintext JSON files. Additionally, the first 80 char ...[truncated 1582 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Memory PoisoningPersistent Context Injection, Context Window Stuffing, Memory Manipulation
- Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (36)
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The uninstall instructions include a forceful recursive deletion of an absolute path under the user's skills directory. Although intended for legitimate uninstall,
rm -rfis inherently dangerous because path mistakes, variable substitution, or copy/paste errors can cause irreversible deletion beyond the intended target.- Content
Remove the skill folder and archive data:
bash rm -rf /Users/atharvadeshmukh/clawd/skills/context-pruner rm -rf ./context-archive # or your custom archive path
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 95% confidence
- Finding
The uninstall instructions include a forceful recursive deletion of an absolute path under the user's skills directory. Although intended for legitimate uninstall,
rm -rfis inherently dangerous because path mistakes, variable substitution, or copy/paste errors can cause irreversible deletion beyond the intended target.- Content
Remove the skill folder and archive data:
bash rm -rf /Users/atharvadeshmukh/clawd/skills/context-pruner rm -rf ./context-archive # or your custom archive path
Tool Parameter Abuse
High
- Category
- Tool Misuse
- Confidence
- 96% confidence
- Finding
The guide instructs users to recursively force-delete
./context-archive, which may contain archived conversation history or other retained data. In the context of this skill, that makes the command more sensitive because it can silently and permanently erase stored memory data without any warning or confirmation.- Content
bash rm -rf /Users/atharvadeshmukh/clawd/skills/context-pruner rm -rf ./context-archive # or your custom archive path
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 97% confidence
- Finding
The documented archive behavior stores conversation data on the local filesystem ('./context-archive') and presents it as automatic functionality without clearly declaring permissions, storage handling, or safeguards. In a context-management skill, silent persistence of prior conversations increases privacy risk because users may assume ephemeral handling while sensitive prompts are retained and later retrieved.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 93% confidence
- Finding
The documented archive behavior stores conversation data on the local filesystem ('./context-archive') and presents it as automatic functionality without clearly declaring permissions, storage handling, or safeguards. In a context-management skill, silent persistence of prior conversations increases privacy risk because users may assume ephemeral handling while sensitive prompts are retained and later retrieved.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 82% confidence
- Finding
The documented archive behavior stores conversation data on the local filesystem ('./context-archive') and presents it as automatic functionality without clearly declaring permissions, storage handling, or safeguards. In a context-management skill, silent persistence of prior conversations increases privacy risk because users may assume ephemeral handling while sensitive prompts are retained and later retrieved.
- Content
Ae1
High
- Category
- analysis-evasion
- Confidence
- 100% confidence
- Finding
Referenced artifact was not completely inspected
- Content
md import { createContextPruner } from './lib/index.js';
Memory Manipulation
High
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.
- Content
js return this.pruner.getStatus(); } // Clear conversation clear() { this.conversation = []; this.pruner.resetStats();
Ssd 3
High
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
Smart archive retrieval semantically resurfaces old archived text into future prompts as system messages, which can disclose prior user content across later interactions and elevate that content's influence. Reinjecting archived material as system-role text is especially risky because it may override current conversation boundaries, amplify stale or sensitive data, and expose past context to downstream LLM calls.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The uninstall section documents recursive deletion commands that permanently remove directories, including user data in the context archive, but does not explicitly warn about data loss or advise users to verify paths before execution. In an installation guide for a context-management skill that stores archived conversation data, this omission increases the chance of accidental destructive use.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The README advertises automatic pruning and a CLI command that writes output files without warning that content may be modified, summarized, or overwritten. In a context-management skill, silent alteration of prompts, chat history, or destination files can cause data loss, integrity issues, or unsafe downstream model behavior if users assume the operation is non-destructive.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill advertises archive storage and retrieval of prior conversation context without warning users that conversation data may be retained. In a context-management skill, this is dangerous because users may disclose secrets, personal data, or proprietary prompts under the assumption that context trimming reduces exposure, while the archive actually preserves and re-surfaces that data.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 89% confidence
- Finding
The manifest promises advanced optimization features including merging, summarizing, extracting, query-aware scoring, hierarchical memory, and chat event logging. This file instead documents a narrower pruning tool with temporal/priority/length strategies and optional semantic removal, indicating the documented behavior is materially different from the declared skill purpose.
- Content
Intent-Code Divergence
Medium
- Category
- Not specified by scanner
- Confidence
- 80% confidence
- Finding
The summary states 'No external dependencies required' and later advertises semantic functionality that 'requires dependencies', which is a direct contradiction within the skill's documentation. It also claims 'stores only current conversation' while the manifest context describes a context archive/hierarchical memory system, creating inconsistent statements about actual retention behavior.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The logger includes a user-derived query fragment in chat-visible logs via
query.substring(0, 30), which can disclose sensitive prompt content, secrets, or personal data to downstream chat participants, logs, or monitoring systems without explicit consent. In this skill's context-optimization role, the archived queries are likely to contain prior conversation material, making inadvertent exposure more likely rather than hypothetical.- Content
Context Window Stuffing
Medium
- Category
- Memory Poisoning
- Confidence
- 80% confidence
- Finding
Skill attempts to fill the context window with filler content, displacing legitimate instructions and safety constraints. This can degrade agent performance or bypass safety boundaries.
- Content
js await contextManager.addMessage( i % 2 === 0 ? 'user' : 'assistant', `Message ${i}: This is part of a long conversation about programming concepts and best practices. ` + `We're discussing various topics to simulate a real conversation that might exceed context limits.`, i % 10 === 0 ? 8 : 5 // Every 10th message is high priority );
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The example enables archive storage to a local path and presents it as a simple integration flow, which can cause user and assistant message content to be persisted to disk without any explicit consent, warning, or retention controls at the integration boundary. In a context-management skill, archived conversation data may contain secrets, personal data, or proprietary prompts, so silent persistence increases privacy and data-handling risk.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md * - Hierarchical memory system with context archive * * LLM calls are routed through SkillBoss API Hub: * POST https://api.heybossai.com/v1/pilot * Authorization: Bearer $SKILLBOSS_API_KEY */
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md * - Hierarchical memory system with context archive * * LLM calls are routed through SkillBoss API Hub: * POST https://api.heybossai.com/v1/pilot * Authorization: Bearer $SKILLBOSS_API_KEY */
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
md * - Hierarchical memory system with context archive * * LLM calls are routed through SkillBoss API Hub: * POST https://api.heybossai.com/v1/pilot * Authorization: Bearer $SKILLBOSS_API_KEY */
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
js * - Hierarchical memory system with context archive * * LLM calls are routed through SkillBoss API Hub: * POST https://api.heybossai.com/v1/pilot * Authorization: Bearer $SKILLBOSS_API_KEY */
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The skill persistently writes pruned context to local JSON files under an archive directory, creating storage of conversation data beyond transient optimization. In a context-management skill, this materially changes the data-handling model and increases exposure to local compromise, unintended reuse, and retention of sensitive content.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The archive store path logs the beginning of raw archived content and associated metadata directly to the console. Because this component handles pruned conversation context, those logs can expose sensitive user prompts, secrets, or prior discussion content to operators, log aggregators, or other local users without any minimization need.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The implementation both persists archived message content and prints content previews without a clear user-facing warning or consent mechanism. This is dangerous because users may reasonably expect context optimization to be ephemeral, while the code creates additional disclosure surfaces through disk and logs.
- Content
Ssd 3
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Logging archived context in plain language creates a direct data-disclosure path for previously pruned user content. Since the component is explicitly designed to handle conversation history, these logs can leak confidential prompts, credentials, or personal data into console output and downstream observability systems.
- Content
Static analysis
No suspicious patterns detected.