Context Cleaner (.md cleanup)

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:30 AM UTC
• Version: 1.0.2

Overview

This skill is a disclosed context-file optimizer, but it can persistently rewrite agent behavior files with broad templates and external delivery instructions.

Install only if you are comfortable letting this skill rewrite persistent OpenClaw agent files. Before running it, use explicit target names, review a full diff before any write, avoid main workspace optimization unless necessary, and remove or verify any Discord delivery instructions introduced by templates.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:33
• Finding: Persistent Agent Behavior Modification Through Unsafe Context Rewriting## Vulnerability Details **File Location**: `SKILL.md`, lines 33-49 and 99-122 **Vulnerability Type**: Persistent instruction and agent-state poisoning **Risk Level**: Critical ### Vulnerable Code ```markdown - **Main workspace:** "context-cleaner your main core files" → optimize main SOUL.md, AGENTS.md, etc. (requires explicit confirmation) ``` ```markdown ⚠️ **WARNING:** Main workspace optimization affects your core behavior. Require explicit user confirmation: ``` ⚠️ This will modify YOUR core files (SOUL.md, AGENTS.md, etc.). This could affect your behavior. Proceed? (yes/no) ``` ``` ```markdown 1. **Single responsibility per file:** - IDENTITY.md: Role + directives only - AGENTS.md: Workflow + boundaries - USER.md: User info only - TASK.md: Directive steps, no explanations - TOOLS.md: Integration IDs + tool params + checklists - SOUL.md: One-liner persona statement ``` ```markdown 4. **Preserve:** - Discord channel IDs (replace with [DISCORD_CHANNEL_ID] placeholder) - Notion DB IDs (replace with [NOTION_DB_ID] placeholder) - API endpoints - Workflow steps - Quality gates - Boundaries (NEVER rules) ### Step 6: Rewrite Files Apply optimized templates. See **Agent Templates** section below. ``` ### Technical Analysis The Skill is declared as a context-token optimizer, but it is authorized to rewrite persistent behavior-defining files such as `SOUL.md`, `AGENTS.md`, `IDENTITY.md`, and `TOOLS.md`. It then instructs the Agent to apply generic replacement templates rather than limiting changes to semantically equivalent compression. Replacing these files can remove existing safety boundaries and introduce new directives, roles, tool-selection rules, or output destinations. Because the modified files are part of the Agent workspace, the altered instructions can continue to affect future sessions. A backup and a general confirmation prompt reduce ...[truncated 1413 chars]
• Remediation: ## Remediation Suggestions - Do not replace context files with generic role templates. - Restrict optimization to semantic-preserving edits, such as removing exact duplication or shortening prose without changing directives. - Treat `SOUL.md`, `IDENTITY.md`, safety boundaries, and tool authorization rules as protected content that cannot be modified by default. - Generate and display a complete per-file diff before making any write. - Require separate, explicit approval for every behavior-affecting change rather than one approval for the entire workspace. - Verify after rewriting that all original safety rules, authorization boundaries, and integration restrictions remain present. - Use an atomic staging directory and restore automatically if validation fails. - Prefer a read-only analysis mode that proposes reductions without applying them.

T02 · Agent Memory Poisoning

Error

• Location: SKILL.md:315
• Finding: Persistent and Unnecessary External Delivery Directive## Vulnerability Details **File Location**: `SKILL.md`, lines 252-254 and 315-316 **Vulnerability Type**: Persistent instruction injection enabling external data transmission **Risk Level**: High ### Vulnerable Code ```markdown **Discord:** [DISCORD_CHANNEL_ID] (deliver findings here) ``` ```markdown ## 5. Deliver Send to Discord channel (see TOOLS.md). Include content + assumption notes. ``` ### Technical Analysis The replacement templates introduce a directive to transmit generated content and assumption notes to a Discord channel. External delivery is unrelated to the Skill's declared purpose of reducing context tokens and is therefore not a necessary privilege. The destination is resolved indirectly through `TOOLS.md`, and the documented workflow does not require destination verification, data classification, per-transmission consent, or confirmation that the channel is controlled by the intended user. Since this directive is inserted into persistent Agent files, it can affect later tasks after the cleanup operation has completed. The finding does not establish that credentials or complete context files are transmitted. The explicitly documented transmitted data is generated content, findings, and assumption notes, which may nevertheless contain confidential user or task information. ### Attack Path 1. The context-cleaner installs the researcher or content-writer template into an Agent workspace. 2. The template persists a Discord delivery directive and references the channel configured in `TOOLS.md`. 3. A later user asks the modified Agent to conduct research or create content containing sensitive information. 4. The Agent follows the persisted delivery step. 5. Content, findings, or assumption notes are sent to the configured Discord channel without a task-specific authorization check. 6. If the channel is incorrect, shared, or attacker-controlled, the information is disclosed externally. ### Impact A ...[truncated 539 chars]
• Remediation: ## Remediation Suggestions - Remove Discord delivery instructions from all optimization templates. - Do not introduce any new network destination while optimizing local context files. - Preserve an existing delivery integration only when it already exists and the user explicitly requests its retention. - Require task-specific confirmation immediately before each external transmission. - Display and validate the exact destination, including server and channel identity, before sending. - Apply data-classification and redaction checks to content and notes before transmission. - Prohibit transmission of secrets, credentials, private context, and internal reasoning or assumption notes. - Keep external delivery disabled by default and separate from the context-cleaning workflow.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:37
• Finding: Unsafe User-Controlled Agent Name Interpolation in Shell Commands## Vulnerability Details **File Location**: `SKILL.md`, lines 37-41, 60-63, and 81-86 **Vulnerability Type**: Shell command injection and path traversal risk **Risk Level**: High ### Vulnerable Code ```bash ls /home/[USER]/.openclaw/workspace/AGENT_NAME/*.md ``` ```bash cd /home/[USER]/.openclaw/workspace # Single agent backup tar -czf agent-backup-AGENT_NAME-TIMESTAMP.tar.gz AGENT_NAME/ ``` ```bash for file in IDENTITY.md AGENTS.md USER.md TASK.md TOOLS.md SOUL.md; do lines=$(wc -l < "AGENT_NAME/$file" 2>/dev/null || echo "0") echo "$file: $lines lines" done ``` ### Technical Analysis `AGENT_NAME` is derived from the user's request and is shown as direct text substitution inside shell commands and paths. The Skill does not define an identifier allowlist, canonical-path validation, option termination, or safe argument-passing mechanism. If an executing Agent performs literal substitution, shell metacharacters can introduce additional commands. Traversal sequences can select paths outside the intended Agent directory, while values beginning with a hyphen can be interpreted as command options. Quoting only some occurrences is insufficient because the `ls` and `tar` examples contain unquoted substitution points, and quoted traversal paths can still escape the intended workspace. ### Attack Path 1. An attacker requests optimization for a crafted agent name containing shell syntax, whitespace, command options, or traversal sequences. 2. The Agent substitutes that value into the documented `ls`, `tar`, or file-analysis commands. 3. The shell interprets injected syntax, or the filesystem resolves the crafted path outside the intended agent directory. 4. The resulting command enumerates, reads, or archives unintended files; where shell syntax is accepted, arbitrary commands may execute with the Agent process's privileges. 5. The generated backup may also collect data beyond the requested workspace ...[truncated 551 chars]
• Remediation: ## Remediation Suggestions - Validate agent names against a strict allowlist such as `^[A-Za-z0-9_-]+$`. - Reject absolute paths, `..`, path separators, whitespace, control characters, shell metacharacters, and values beginning with `-`. - Resolve the target with a canonical-path operation and verify that it remains directly beneath the expected workspace root. - Pass validated values as quoted positional parameters rather than interpolating them into command strings. - Use `--` before path operands where supported, for example `tar -czf "$archive" -- "$agent_dir"`. - Replace shell globbing and `ls` parsing with a filesystem API where possible. - Construct backups through a fixed workspace file descriptor or trusted base directory. - Abort before any read or write when validation or canonicalization fails.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrase "clean up agent files" is broad enough to match ordinary user requests about organizing or tidying files rather than intentionally invoking a workspace-rewriting skill. Because this skill performs destructive file modifications and backup/restore operations, accidental activation could cause unintended changes to agent or workspace configuration files.

Vague Triggers

Medium

• Confidence: 86% confidence
• Finding: The phrase "optimize agent context" is ambiguous and could be interpreted as a general request to improve prompts, summarize text, or adjust context usage, causing this skill to activate outside the user's intended scope. In this skill, activation leads to filesystem writes, templated rewrites, and possible replacement of existing operational content, so ambiguous matching increases the risk of unintended modification.

Static analysis

No suspicious patterns detected.