Security audit

Context Hawk

Security checks across malware telemetry and agentic risk

Overview

Context-Hawk is mostly a memory tool, but it includes under-scoped scripts that can import existing OpenClaw memories and automatically commit and push repository changes.

Install only after reviewing the scripts you plan to run. Prefer pip installation over curl-to-bash, avoid running scripts/install.sh unless you intentionally want to import OpenClaw memories, do not enable cloud extraction or embeddings for sensitive conversations without understanding the provider, and do not schedule the cron health-check script unless automatic git commits and pushes are acceptable.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (71)

Tainted flow: 'req' from os.environ.get (line 263, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Content: "X-Title": "hawk-bridge", } ) with urllib.request.urlopen(req, timeout=30) as resp: result = json.loads(resp.read()) content = result["choices"][0]["message"]["content"] return parse_and_validate(content)
Confidence: 90% confidence
Finding: with urllib.request.urlopen(req, timeout=30) as resp:

Tainted flow: 'req' from os.environ.get (line 358, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Content: "Content-Type": "application/json", } ) with urllib.request.urlopen(req, timeout=30) as resp: result = json.loads(resp.read()) content = result["choices"][0]["message"]["content"] return parse_and_validate(content)
Confidence: 89% confidence
Finding: with urllib.request.urlopen(req, timeout=30) as resp:

Tainted flow: 'req' from os.environ.get (line 358, credential/environment) → urllib.request.urlopen (network output)

Critical

Category: Data Flow
Content: "Content-Type": "application/json", } ) with urllib.request.urlopen(req, timeout=30) as resp: result = json.loads(resp.read()) content = result["choices"][0]["message"]["content"] return parse_and_validate(content)
Confidence: 87% confidence
Finding: with urllib.request.urlopen(req, timeout=30) as resp:

Intent-Code Divergence

High

Confidence: 99% confidence
Finding: The method documents `dry_run` as non-mutating, but it still calls the real strategy function for every memory item. Because those strategy functions perform destructive or state-changing actions such as delete, summarize, promote, or archive and call `_save()`, a caller relying on `dry_run=True` can unintentionally modify or delete persisted memory data.

Intent-Code Divergence

Medium

Confidence: 96% confidence
Finding: The code checks for the exact string '' to skip files, but later appends ''. Because the skip condition never matches the written marker, previously imported files will be reprocessed on every run. In this context that can repeatedly resend user markdown content to the external embeddings API and recreate database contents, causing unintended data exposure, duplicate processing, and cost.

Intent-Code Divergence

High

Confidence: 94% confidence
Finding: The script is described as a health check, but on test failure it stages all changes and performs a git commit and push automatically. This is dangerous because a periodic check should be non-mutating by default; coupling failure handling with repository write access can silently propagate unintended, unreviewed, or attacker-influenced changes to a remote repository.

Context-Inappropriate Capability

Medium

Confidence: 96% confidence
Finding: The installer reads from $HOME/.openclaw/memory, which is an unrelated application's data directory, and imports that data automatically during setup. This creates an unexpected cross-application data flow that can expose private user content, violate user expectations, and import untrusted data into the new tool without review.

Intent-Code Divergence

Low

Confidence: 88% confidence
Finding: The comment frames the behavior as importing 'existing memories' if present, but the code specifically targets another product's directory, which obscures the real data source. That mismatch can mislead reviewers and users, reducing scrutiny around a privacy-sensitive migration path.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The README recommends executing a shell script fetched directly from the internet via curl-pipe/bash style installation without any integrity verification, pinning, or warning. This is dangerous because a compromised upstream repository, MITM in a weaker environment, or malicious update to install.sh could lead to arbitrary code execution on the user's machine.

Missing User Warnings

Medium

Confidence: 86% confidence
Finding: El README promociona memoria persistente entre sesiones y almacenamiento de preferencias/estado de tarea, pero no advierte claramente que puede guardar datos sensibles del usuario en disco local. En una skill de memoria contextual, esta omisión es especialmente relevante porque el comportamiento central del producto es recopilar, retener y reinyectar información potencialmente privada, aumentando el riesgo de exposición accidental, retención excesiva o incumplimiento de expectativas de privacidad.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: El README instruye a ejecutar un comando `bash <(curl ...)` que descarga y ejecuta un script remoto directamente, sin verificación de integridad, fijación de versión ni advertencia de riesgo. Esto es peligroso porque cualquier compromiso del repositorio, del canal de distribución o un cambio inesperado en `master` puede resultar en ejecución arbitraria de código en la máquina del usuario.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README prominently advertises cross-session memory and persistent recall, but it does not clearly warn users that conversation content, preferences, and task data may be retained on local storage. In a memory-management skill, this omission is security-relevant because users may disclose sensitive information under the assumption that context is ephemeral, increasing privacy and data-retention risk.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The one-line installation command executes a remote script directly via curl-to-bash without any integrity verification, pinning, or review step. This is dangerous because a compromised upstream repository, man-in-the-middle in a weaker environment, or malicious update could result in arbitrary code execution on the user's machine during installation.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The task-state section demonstrates that detailed task descriptions, outputs, constraints, and progress are written to local JSONL files and survive restarts, but it does not warn users about this retention. That can expose sensitive project details, internal filenames, and user workflows to other local users, backups, endpoint tools, or later unintended reuse.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The structured memory examples describe ongoing storage of conversation-derived content, preferences, decisions, and knowledge, but provide no explicit privacy or data-handling warning. In the context of a tool designed to remember user interactions, this is especially risky because it normalizes long-term collection of potentially sensitive conversational data without informed consent or clear retention boundaries.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README instructs users to execute a remote script directly via `bash <(curl ...)`, which bypasses any opportunity to inspect the downloaded code before execution. If the hosting source, repository, network path, or referenced script is compromised, this becomes an immediate arbitrary code execution path on the user's system.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The README recommends a one-line `bash <(curl ...)` installer that fetches and immediately executes remote code without any integrity verification, pinning, or explicit warning. If the upstream repository, transport path, or referenced script is compromised, users can execute arbitrary code on their systems directly from the installation instructions.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The README explicitly recommends `bash <(curl -fsSL ...)`, which streams and executes remote shell code without prior integrity verification, pinning, or user warning. If the upstream repository, distribution channel, or network path is compromised, users can execute arbitrary code immediately on their system.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The README explicitly recommends a one-line `curl|bash` installer that executes remote shell code directly from GitHub. This is dangerous because users cannot inspect the script before execution, and any compromise of the upstream repository, distribution path, or network environment could lead to arbitrary code execution on the user's machine.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README promotes persistent storage of task state and memory across sessions, including potentially sensitive user preferences, outputs, constraints, and work history, but does not clearly warn about retention, local storage location, or handling of sensitive data. In a memory-focused agent skill, this increases the risk of unintentionally retaining secrets, personal data, or regulated information longer than users expect.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The README advertises shared cross-agent memory where multiple agents can read and write the same LanceDB-backed context, but it does not clearly warn about data boundary, isolation, or authorization risks. This is dangerous because one agent may expose or contaminate another agent's context, causing unintended disclosure, prompt/data poisoning, or cross-tenant leakage if the store is reused broadly.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The README explicitly recommends piping a remote script from GitHub directly into `bash`, which is a classic supply-chain risk. If the remote content, repository, branch, network path, or hosting account is compromised, users may execute arbitrary code immediately with no review or integrity verification.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The README instructs users to execute a remote script directly via `bash <(curl ...)`, which bypasses review of the downloaded content and creates a straightforward path for supply-chain compromise if the upstream repository, network path, or referenced script is tampered with. In a skill ecosystem, users may copy-paste install commands with elevated trust, making this more dangerous than ordinary documentation because it normalizes unaudited code execution during setup.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: README 明确提供了 `bash <(curl -fsSL ...)` 这种直接获取并执行远程脚本的安装方式，却没有任何校验、固定版本、签名验证或风险提示。若上游仓库、发布链路或网络被劫持，用户会在本机直接执行任意代码，这对一个面向 agent/CLI 的技能尤其危险，因为安装通常发生在高权限开发环境中。

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: README 展示了把 API Key 直接写入 `~/.hawk/config.json` 的做法，但未提醒文件权限、明文存储风险、避免提交到版本控制或使用环境变量/系统密钥链等更安全替代方案。该技能本身围绕持久化记忆与跨 session 保存运行，意味着用户更可能长期保存敏感配置，凭证泄露后的暴露窗口更大。

VirusTotal

67/67 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.