context-engineer

• Outcome: Pass
• Latest audit: Sep 10, 2026 · 9:04 PM UTC
• Version: 1.0.2

Overview

This skill is a local context-analysis utility that reads user-selected workspace and config files to report token usage, without network exfiltration or hidden persistence.

Install only if you are comfortable with a local utility reading agent context files, installed skill definitions, and OpenClaw/tool configuration from the workspace you point it at. Avoid running it on workspaces containing sensitive instructions or secrets unless you want those contents analyzed locally and potentially summarized in terminal output or snapshots.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (5)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence
• Finding: The skill exposes executable commands that read workspace files, read configuration, and write snapshot files, but the manifest does not declare any tool scope such as permissions or allowed-tools. That omission weakens least-privilege controls and makes it harder for a host agent or reviewer to understand and constrain what the skill can access before invocation.

Missing User Warnings

Low

• Confidence: 81% confidence
• Finding: This code reads the contents of top-level workspace files, which may include sensitive prompt, memory, or configuration data, but only documents token estimation and reporting behavior at a high level. There is no explicit user-facing notice at the point of execution that the tool will inspect and process file contents from the workspace.

Missing User Warnings

Low

• Confidence: 80% confidence
• Finding: The tool reads each skills/*/SKILL.md file and processes its full contents, which may contain operational instructions or other sensitive metadata. While this is functionally expected for context analysis, the code lacks a specific warning or disclosure telling users that skill definitions will be read from nested directories.

Missing User Warnings

Low

• Confidence: 84% confidence
• Finding: The code scans .openclaw, .claude, and .cursor directories and reads markdown files from them, which may contain sensitive local instructions or configuration details. There is no specific disclosure in the code or CLI help that these hidden configuration directories are included in the scan scope.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The audit-tools command opens and parses the supplied config file, potentially exposing tool definitions or embedded configuration details during analysis. Although this aligns with the command purpose, there is no explicit disclosure in the code or help text that the file contents are read and inspected.

Static analysis

No suspicious patterns detected.