Context Budgeting

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 3:15 PM UTC
• Version: 1.0.0

Overview

This skill is a disclosed context-management helper, but users should review what it writes into persistent memory before relying on it.

Install only if you want an agent to maintain persistent context checkpoints. Review or constrain HOT_MEMORY.md updates so they contain factual task state, not copied commands, policy changes, credentials, or untrusted instructions.

A.I.G

Vulnerability Patterns

• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

Findings (1)

T02 · Agent Memory Poisoning

Warning

• Location: SKILL.md:19

Finding

Untrusted Session Content Can Be Persisted into Agent Memory

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 19–23
Vulnerability Type: Persistent agent memory poisoning
Risk Level: Medium

Vulnerable Code Snippet:

markdown

Before any compaction (manual or automatic), the agent MUST:
1.  **Generate Checkpoint**: Update `memory/hot/HOT_MEMORY.md` with:
    - **Status**: Current task progress.
    - **Key Decision**: Significant choices made.
    - **Next Step**: Immediate action required.

Technical Analysis

The skill mandates writing session-derived status, decisions, and next steps into the persistent memory/hot/HOT_MEMORY.md file. It does not define trust boundaries, provenance tracking, validation, instruction neutralization, or restrictions against copying directives from untrusted user or retrieved content.

If malicious instructions are incorporated into a checkpoint—particularly under the “Key Decision” or “Next Step” fields—they may later be interpreted as trusted operational guidance. This changes an instruction that would otherwise be limited to the current session into persistent state capable of influencing future sessions.

The vulnerability does not itself grant operating-system privileges. Exploitation depends on the agent subsequently loading the memory file and treating its contents as authoritative instructions.

Attack Path

1. An attacker supplies content containing a malicious directive during a session.
2. The context approaches compaction, causing the mandatory checkpoint procedure to run.
3. The agent summarizes the attacker-controlled directive as a decision or next step.
4. The resulting text is written to memory/hot/HOT_MEMORY.md.
5. A later session loads or references that persistent memory.
6. If the stored directive is treated as trusted guidance, it can alter subsequent agent actions or task priorities.

Impact Assessment

Successful exploitation can produce cross-session manipulation of the age ...[truncated 481 chars]

Remediation

View remediation

Remediation Suggestions

1. Define a strict checkpoint schema that permits factual state only and prohibits executable instructions, policy changes, credentials, and commands copied from untrusted content.
2. Record provenance and trust level for every checkpoint entry, distinguishing user input, retrieved content, tool output, and agent-generated conclusions.
3. Quote or escape untrusted text and clearly label it as data that must not be executed or followed as an instruction.
4. Validate each “Key Decision” and “Next Step” against the authenticated user's current objective and the agent's governing policies before persistence.
5. Require explicit confirmation before a future session promotes a stored next step into an actionable instruction.
6. Apply expiration, review, and rollback controls to persistent memory entries.
7. Add a requirement that future sessions treat checkpoint content as untrusted context until it has been revalidated.

SkillSpector

Vulnerability Patterns

• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

The description promises a fairly comprehensive context-window management tool with partitioning, checkpointing, and lifecycle management for specific context-pressure situations. The supplied code does much less: it only echoes messages and runs an openclaw sessions --active 1 command, apparently intended to trigger compaction or inspect an active session. The HOT_MEMORY update is explicitly a placeholder and no file write occurs. Cleanup logic is commented out. Because the primary declared capabilities are largely unimplemented, this is a material description-to-behavior mismatch.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.