Context Cleaner (.md cleanup)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:30 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed context-file optimizer, but it can persistently rewrite agent behavior files with broad templates and external delivery instructions.

Install only if you are comfortable letting this skill rewrite persistent OpenClaw agent files. Before running it, use explicit target names, review a full diff before any write, avoid main workspace optimization unless necessary, and remove or verify any Discord delivery instructions introduced by templates.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:33

Finding

Persistent Agent Behavior Modification Through Unsafe Context Rewriting

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 33-49 and 99-122
Vulnerability Type: Persistent instruction and agent-state poisoning
Risk Level: Critical

Vulnerable Code

markdown

- **Main workspace:** "context-cleaner your main core files" → optimize main SOUL.md, AGENTS.md, etc. (requires explicit confirmation)

markdown

⚠️ **WARNING:** Main workspace optimization affects your core behavior. Require explicit user confirmation:

⚠️ This will modify YOUR core files (SOUL.md, AGENTS.md, etc.). This could affect your behavior.

Proceed? (yes/no)

text

markdown

1. **Single responsibility per file:**
   - IDENTITY.md: Role + directives only
   - AGENTS.md: Workflow + boundaries
   - USER.md: User info only
   - TASK.md: Directive steps, no explanations
   - TOOLS.md: Integration IDs + tool params + checklists
   - SOUL.md: One-liner persona statement

markdown

4. **Preserve:**
   - Discord channel IDs (replace with [DISCORD_CHANNEL_ID] placeholder)
   - Notion DB IDs (replace with [NOTION_DB_ID] placeholder)
   - API endpoints
   - Workflow steps
   - Quality gates
   - Boundaries (NEVER rules)

### Step 6: Rewrite Files

Apply optimized templates. See **Agent Templates** section below.

Technical Analysis

The Skill is declared as a context-token optimizer, but it is authorized to rewrite persistent behavior-defining files such as SOUL.md, AGENTS.md, IDENTITY.md, and TOOLS.md. It then instructs the Agent to apply generic replacement templates rather than limiting changes to semantically equivalent compression.

Replacing these files can remove existing safety boundaries and introduce new directives, roles, tool-selection rules, or output destinations. Because the modified files are part of the Agent workspace, the altered instructions can continue to affect future sessions. A backup and a general confirmation prompt reduce ...[truncated 1413 chars]

Remediation

View remediation

Remediation Suggestions

• Do not replace context files with generic role templates.
• Restrict optimization to semantic-preserving edits, such as removing exact duplication or shortening prose without changing directives.
• Treat SOUL.md, IDENTITY.md, safety boundaries, and tool authorization rules as protected content that cannot be modified by default.
• Generate and display a complete per-file diff before making any write.
• Require separate, explicit approval for every behavior-affecting change rather than one approval for the entire workspace.
• Verify after rewriting that all original safety rules, authorization boundaries, and integration restrictions remain present.
• Use an atomic staging directory and restore automatically if validation fails.
• Prefer a read-only analysis mode that proposes reductions without applying them.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:315

Finding

Persistent and Unnecessary External Delivery Directive

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 252-254 and 315-316
Vulnerability Type: Persistent instruction injection enabling external data transmission
Risk Level: High

Vulnerable Code

markdown

**Discord:** [DISCORD_CHANNEL_ID] (deliver findings here)

markdown

## 5. Deliver
Send to Discord channel (see TOOLS.md). Include content + assumption notes.

Technical Analysis

The replacement templates introduce a directive to transmit generated content and assumption notes to a Discord channel. External delivery is unrelated to the Skill's declared purpose of reducing context tokens and is therefore not a necessary privilege.

The destination is resolved indirectly through TOOLS.md, and the documented workflow does not require destination verification, data classification, per-transmission consent, or confirmation that the channel is controlled by the intended user. Since this directive is inserted into persistent Agent files, it can affect later tasks after the cleanup operation has completed.

The finding does not establish that credentials or complete context files are transmitted. The explicitly documented transmitted data is generated content, findings, and assumption notes, which may nevertheless contain confidential user or task information.

Attack Path

1. The context-cleaner installs the researcher or content-writer template into an Agent workspace.
2. The template persists a Discord delivery directive and references the channel configured in TOOLS.md.
3. A later user asks the modified Agent to conduct research or create content containing sensitive information.
4. The Agent follows the persisted delivery step.
5. Content, findings, or assumption notes are sent to the configured Discord channel without a task-specific authorization check.
6. If the channel is incorrect, shared, or attacker-controlled, the information is disclosed externally.

Impact A

...[truncated 539 chars]

Remediation

View remediation

Remediation Suggestions

• Remove Discord delivery instructions from all optimization templates.
• Do not introduce any new network destination while optimizing local context files.
• Preserve an existing delivery integration only when it already exists and the user explicitly requests its retention.
• Require task-specific confirmation immediately before each external transmission.
• Display and validate the exact destination, including server and channel identity, before sending.
• Apply data-classification and redaction checks to content and notes before transmission.
• Prohibit transmission of secrets, credentials, private context, and internal reasoning or assumption notes.
• Keep external delivery disabled by default and separate from the context-cleaning workflow.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:37

Finding

Unsafe User-Controlled Agent Name Interpolation in Shell Commands

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 37-41, 60-63, and 81-86
Vulnerability Type: Shell command injection and path traversal risk
Risk Level: High

Vulnerable Code

bash

ls /home/[USER]/.openclaw/workspace/AGENT_NAME/*.md

bash

cd /home/[USER]/.openclaw/workspace

# Single agent backup
tar -czf agent-backup-AGENT_NAME-TIMESTAMP.tar.gz AGENT_NAME/

bash

for file in IDENTITY.md AGENTS.md USER.md TASK.md TOOLS.md SOUL.md; do
  lines=$(wc -l < "AGENT_NAME/$file" 2>/dev/null || echo "0")
  echo "$file: $lines lines"
done

Technical Analysis

AGENT_NAME is derived from the user's request and is shown as direct text substitution inside shell commands and paths. The Skill does not define an identifier allowlist, canonical-path validation, option termination, or safe argument-passing mechanism.

If an executing Agent performs literal substitution, shell metacharacters can introduce additional commands. Traversal sequences can select paths outside the intended Agent directory, while values beginning with a hyphen can be interpreted as command options. Quoting only some occurrences is insufficient because the ls and tar examples contain unquoted substitution points, and quoted traversal paths can still escape the intended workspace.

Attack Path

1. An attacker requests optimization for a crafted agent name containing shell syntax, whitespace, command options, or traversal sequences.
2. The Agent substitutes that value into the documented ls, tar, or file-analysis commands.
3. The shell interprets injected syntax, or the filesystem resolves the crafted path outside the intended agent directory.
4. The resulting command enumerates, reads, or archives unintended files; where shell syntax is accepted, arbitrary commands may execute with the Agent process's privileges.
5. The generated backup may also collect data beyond the requested workspace ...[truncated 551 chars]

Remediation

View remediation

Remediation Suggestions

• Validate agent names against a strict allowlist such as ^[A-Za-z0-9_-]+$.
• Reject absolute paths, .., path separators, whitespace, control characters, shell metacharacters, and values beginning with -.
• Resolve the target with a canonical-path operation and verify that it remains directly beneath the expected workspace root.
• Pass validated values as quoted positional parameters rather than interpolating them into command strings.
• Use -- before path operands where supported, for example tar -czf "$archive" -- "$agent_dir".
• Replace shell globbing and ls parsing with a filesystem API where possible.
• Construct backups through a fixed workspace file descriptor or trusted base directory.
• Abort before any read or write when validation or canonicalization fails.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The trigger phrase "clean up agent files" is broad enough to match ordinary user requests about organizing or tidying files rather than intentionally invoking a workspace-rewriting skill. Because this skill performs destructive file modifications and backup/restore operations, accidental activation could cause unintended changes to agent or workspace configuration files.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The phrase "optimize agent context" is ambiguous and could be interpreted as a general request to improve prompts, summarize text, or adjust context usage, causing this skill to activate outside the user's intended scope. In this skill, activation leads to filesystem writes, templated rewrites, and possible replacement of existing operational content, so ambiguous matching increases the risk of unintended modification.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.