Tiered Context Manager

• Outcome: Review
• Latest audit: May 28, 2026 · 6:48 AM UTC
• Version: 1.0.0

Overview

This skill is a real context manager, but it needs Review because it can broadly read, rewrite, delete, and share conversation-derived data across local OpenClaw storage without clear controls.

Install only if you intentionally want a broad local multi-agent context manager. Run dry-run modes first, review the hardcoded OpenClaw paths, keep backups, and avoid using it on sessions that may contain credentials, private user data, or confidential prompts unless you add redaction and access controls.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (22)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 86% confidence
• Finding: The skill advertises executable commands and API usage that read session files and appear to generate reports and maintain state, yet the skill manifest does not declare any permissions. This creates a transparency and governance gap: users and orchestrators cannot accurately assess or constrain file access, which is especially risky for a context-management skill that may touch sensitive conversation history and memory data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose presents the skill as a context-management utility, but the described behavior extends to broad filesystem scanning, cross-agent shared-state writes, memory cleanup/deletion, migration of stored memories, report/export generation, and task-queue processing. This mismatch is dangerous because it obscures materially more powerful behavior than users would expect, increasing the chance of unauthorized data modification, retention changes, lateral data exposure across agents, and destructive file operations in sensitive agent state directories.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The completion logic marks every occurrence of `status: in_progress:xiaozhua` in the shared queue file as done, instead of only the task associated with the provided `session_file`. In a multi-agent shared-memory system, this can cause unrelated in-progress tasks to be falsely completed, leading to task loss, skipped processing, and corruption of inter-agent workflow state.

Description-Behavior Mismatch

Medium

• Confidence: 92% confidence
• Finding: The engine exposes cross-agent extraction, publication, and handoff APIs that go beyond local session compression into data redistribution. Because these methods operate on session files and are framed as knowledge sharing, they can enable unintended propagation of sensitive conversation content across agents or stores without clear scoping, consent, or sanitization.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The code persists backups to a hard-coded external workspace path and supports rollback from those copies, creating durable replicas of session data outside the active session file. This expands the data exposure surface, may bypass expected retention boundaries, and can leak sensitive content to other tools or users with access to that fixed location.

Context-Inappropriate Capability

Medium

• Confidence: 87% confidence
• Finding: The L3 path creates external inbox tasks instead of performing purely local compaction, introducing side effects that can export session metadata or content into another processing channel. That delegation increases the attack surface and may cause sensitive context to be queued for separate handling without sufficient visibility or access control.

Context-Inappropriate Capability

Medium

• Confidence: 93% confidence
• Finding: The script dynamically loads and executes code from a hard-coded workspace plugin path via require(TIERED_ENGINE_PATH). That gives whoever can modify that plugin file arbitrary code execution in the context of this scanner, which is broader than simple session scanning/compression and creates a trust-boundary violation. In a multi-agent/shared-workspace environment, this is especially risky because plugin contents may be mutable by other tools, agents, or users.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The script writes actionable instructions into a shared inbox that direct another AI/agent to read session files and rewrite them. This creates an indirect execution/orchestration channel across agents, expanding the blast radius from local maintenance into cross-agent behavior that could be abused to trigger unauthorized processing of sensitive sessions.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The architecture explicitly includes cross-agent knowledge sharing via functions such as extractAndPublish(), createContextPackage(), and getRecentKnowledge() without any mention of consent, scoping, redaction, or access controls. In a context-management skill, this can cause sensitive conversation content, credentials, or user-specific data to be propagated to other agents beyond the original trust boundary.

Missing User Warnings

Medium

• Confidence: 86% confidence
• Finding: The document describes realtime session monitoring and history analysis but does not warn that conversation data is being observed, analyzed, and used for threshold adjustment. Monitoring in a multi-agent conversation system can expose sensitive prompts, outputs, and behavioral metadata, especially if users or downstream agents are unaware of collection and analysis.

Missing User Warnings

High

• Confidence: 97% confidence
• Finding: This code persists extracted session-derived content into a shared memory file and per-agent context files without any consent check, minimization, or access-control boundary. Because session messages may contain sensitive user instructions, secrets, paths, or operational details, silently copying them into shared storage materially increases exposure and enables unintended cross-agent data leakage.

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The handoff flow writes extracted knowledge and recent message previews into another agent's inbox, effectively transferring user/session data across trust boundaries in plain text. This is dangerous because previews can contain sensitive conversational content, and the receiving agent may not be authorized to access the original session context.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The module copies session-derived content into shared inbox/result files under a global shared path, which can expose private conversation data to other agents, users, or processes with access to that directory. In a multi-agent context manager, sessions may contain secrets, credentials, internal prompts, or sensitive user data, so duplicating them into broadly shared storage materially increases disclosure risk.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: This code permanently deletes expired ephemeral memory files with fs.unlinkSync when dryRun is false, without any confirmation, approval gate, trash/recycle-bin behavior, or audit logging. In a context-management skill, those files may still contain valuable agent state or user data, so silent destructive cleanup can cause data loss and undermine integrity and recoverability.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The code persists per-session compression history, token counts, timestamps, and session identifiers to disk, and also provides an export function that writes the full statistics/history object to a file. In a context manager for multi-agent conversations, those artifacts can reveal sensitive metadata and potentially operationally sensitive usage patterns without any access control, retention limits beyond a short history array, redaction, or explicit disclosure to users.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script persists user-supplied task, decision, and session data into a shared markdown file and also copies it into a backup directory, but it provides no consent prompt, warning, minimization, or sensitivity checks. In a multi-agent shared-memory context, this increases the chance that secrets, internal reasoning, or personal data provided on the command line are unintentionally retained and exposed to other agents or later sessions.

Ssd 3

High

• Confidence: 95% confidence
• Finding: The module is explicitly designed to extract and share knowledge between agents from session content, which creates a built-in data exfiltration and retention pathway. In a context-management skill this functionality is expected, but it is still risky because it operationalizes broad cross-agent sharing of potentially sensitive user data without any visible privacy or policy enforcement.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The extraction patterns intentionally target preferences, remembered items, facts, configuration, paths, commands, and other details that often include sensitive operational or personal information. This broad semantic harvesting makes accidental collection of credentials, internal file locations, security instructions, or private user data likely, especially when applied to whole sessions automatically.

Ssd 3

High

• Confidence: 98% confidence
• Finding: The handoff package combines summarized knowledge with previews of the latest messages, creating a straightforward mechanism to relay potentially sensitive session data to another agent. In a multi-agent system this increases the blast radius of any sensitive content and can propagate prompt injection, secrets, or confidential instructions beyond the original conversation scope.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The generated prompt explicitly instructs preservation of user preferences, key decisions, and system configuration in shared task/result artifacts, creating a durable plaintext summary of sensitive session details. Summaries often concentrate the most valuable information, making exfiltration easier than stealing full logs and increasing privacy and security impact in a shared-memory multi-agent environment.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: Functions that extract and publish session knowledge or create handoff packages are inherently capable of moving user-provided data beyond its original context. In a context-management skill, this is especially dangerous because session files often contain prompts, tool outputs, credentials, or sensitive operational details that may be disclosed to other agents or persistence layers.

Ssd 3

Medium

• Confidence: 87% confidence
• Finding: The inbox task explicitly instructs another AI to read full session contents and write back a summary, creating a plain-language mechanism for broad data access and transformation. Because session files can contain sensitive prompts, secrets, or user data, this delegation can expose or mishandle information, particularly in a shared memory/inbox system where other agents may observe or act on the task.

Static analysis

No suspicious patterns detected.