ClawHub
Back to skill

Security audit

上下文优化器

Security checks for vulnerabilities and agentic risk

Overview

This skill is not clearly malicious, but it asks to read and potentially rewrite sensitive OpenClaw context files and can set up persistent automated optimization with weak scoping.

Review carefully before installing. Use it only on workspaces where you are comfortable exposing OpenClaw memory, identity, user, and tool files to the optimizer process. Prefer read-only analysis first, do not enable the weekly cron or CI auto-commit workflow unless you add review gates, and inspect diffs and generated skills before accepting any rewrite or extracted skill.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T06 · System Persistence

Warning
Location
EXAMPLES.md:112
Finding

User-Mediated Installation of a Persistent Scheduled Agent Task

Content
View full analysis

Vulnerability Details

File Location: EXAMPLES.md:112-116; related command construction in setup_and_test.py:190-200
Vulnerability Type: Persistent scheduled execution
Risk Level: Medium

Evidence

bash
openclaw cron add --name "weekly-context-optimization" \
  --cron "0 2 * * 1" \
  --message "[weekly workspace analysis and optimization instruction]" \
  --description "[weekly context optimization task]"

The source instructs the user to register an OpenClaw cron task that runs every Monday at 02:00. The setup script constructs the same command and directs the user to execute it manually.

Technical Analysis

The documented workflow creates a scheduled OpenClaw task that survives the current skill invocation. Its instruction requests recurring analysis and optimization of workspace context and extraction of new skills. Those operations can affect persistent Agent control files, including AGENTS.md, SOUL.md, MEMORY.md, and HEARTBEAT.md.

The setup script does not automatically execute the cron add command; therefore, exploitation requires the user to follow the printed or documented installation instructions. Nevertheless, once installed, the task establishes cross-session behavior without requiring a new task-specific authorization each week.

Attack Path

  1. A user installs the skill and follows the scheduling instructions in EXAMPLES.md or setup_and_test.py.
  2. The user executes the generated openclaw cron add command.
  3. OpenClaw stores a weekly scheduled task.
  4. On each scheduled run, the Agent receives an instruction to analyze and optimize workspace files and extract skills.
  5. If the invoked optimizer supports modification, persistent Agent context may be changed without fresh approval.

Impact Assessment

The resulting task persists across sessions and may repeatedly operate on Agent configuration, identity, memory, and behavioral files. Its effective p ...[truncated 225 chars]

Remediation
View remediation

Remediation Suggestions

  1. Remove instructions that schedule write-capable optimization tasks by default.
  2. Restrict any scheduled task to read-only analysis and report generation.
  3. Require explicit interactive approval before modifying context files or creating new skills.
  4. Display the exact files and proposed changes before each write.
  5. Add expiration, disable, and removal instructions for scheduled tasks.
  6. Record an audit log for every scheduled invocation and resulting file change.
  7. Use an allowlist of approved files rather than a broad workspace operation.

T05 · Unauthorized Access and Privilege Escalation

Note
Location
simple_optimizer.py:50
Finding

Overly Broad Collection of Sensitive Agent Workspace Files

Content
View full analysis

Vulnerability Details

File Location: simple_optimizer.py:50-58; equivalent access in ascii_optimizer.py:48-56 and optimizer_fixed.py:23-25,65
Vulnerability Type: Excessive access to persistent Agent state
Risk Level: Low

Evidence

python
files_to_analyze = [
    "AGENTS.md",
    "SOUL.md",
    "MEMORY.md",
    "HEARTBEAT.md",
    "TOOLS.md",
    "IDENTITY.md",
    "USER.md"
]

The selected files are subsequently opened and fully loaded:

python
with open(filepath, 'r', encoding='utf-8') as f:
    content = f.read()

A separate implementation expands the scope to every top-level Markdown file:

python
md_files = list(self.workspace_path.glob("*.md"))

Technical Analysis

The analyzers load complete contents of memory, identity, user, tool, behavioral, and control files even though the generated reports use only aggregate measurements such as character counts, line counts, duplicate rates, and estimated token counts.

This violates least-privilege principles because a metrics-oriented analysis does not necessarily require unrestricted access to every sensitive workspace file. The wildcard implementation may also read unrelated Markdown documents added to the workspace.

No network transmission, remote endpoint, credential extraction, or report serialization of complete file contents was found. Consequently, this is an excessive local access issue rather than confirmed exfiltration.

Attack Path

  1. The user runs one of the analyzer scripts.
  2. The script selects fixed sensitive files or enumerates all top-level Markdown files.
  3. Each selected file is opened with the privileges of the current user.
  4. Its complete contents are loaded into the optimizer process.
  5. Derived metrics and filenames are written to workspace reports.

Exploitation would require additional malicious or compromised logic in the same process to misuse the loaded conte ...[truncated 545 chars]

Remediation
View remediation

Remediation Suggestions

  1. Require users to explicitly select every file to be analyzed.
  2. Exclude MEMORY.md, IDENTITY.md, USER.md, and unrelated documents by default.
  3. Replace wildcard Markdown discovery with a narrowly defined allowlist.
  4. Provide separate consent for files likely to contain personal or persistent state.
  5. Process content incrementally where possible and discard it immediately after computing metrics.
  6. Never include raw file contents in reports, logs, exceptions, or telemetry.
  7. Resolve paths and verify that selected files remain inside the approved workspace directory.
  8. Document exactly which files are accessed and why each file is necessary.

SkillSpector

Vulnerability Patterns
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (32)

Tp4

High
Category
MCP Tool Poisoning
Confidence
94% confidence
Finding

The skill implies it will actively reduce token usage through modifications, but the available behavior only estimates token counts and suggests next steps. Misrepresentation of automatic action versus advisory analysis can cause unsafe reliance, accidental approval of writes, or incorrect assumptions about what has and has not changed in the workspace.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
90% confidence
Finding

The skill implies it will actively reduce token usage through modifications, but the available behavior only estimates token counts and suggests next steps. Misrepresentation of automatic action versus advisory analysis can cause unsafe reliance, accidental approval of writes, or incorrect assumptions about what has and has not changed in the workspace.

Content

No source excerpt is available for this finding.

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill implies it will actively reduce token usage through modifications, but the available behavior only estimates token counts and suggests next steps. Misrepresentation of automatic action versus advisory analysis can cause unsafe reliance, accidental approval of writes, or incorrect assumptions about what has and has not changed in the workspace.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · EXAMPLES.md (reported line 88)May include surrounding context.

md
"target_reduction": 60,
  "preserve_format": true,
  "backup_original": true,
  "auto_approve": false,
  "skill_extraction": {
    "min_complexity": 3,
    "reuse_potential": "high",

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · setup_and_test.py (reported line 146)May include surrounding context.

python
"target_reduction": 60,
  "preserve_format": true,
  "backup_original": true,
  "auto_approve": false,
  "skill_extraction": {
    "min_complexity": 3,
    "reuse_potential": "high",

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The examples encourage automated workspace optimization and Git auto-commit of modified files without prominent, adjacent warnings about review, rollback, or unintended content changes. In this skill's context, the tool rewrites agent/workspace context files, so unattended execution could silently corrupt instructions, remove important safeguards, or persist bad changes into version control.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
94% confidence
Finding

The skill describes capabilities that analyze workspace files, back up originals, generate reports, and potentially create or modify skills, but it declares no explicit tool scope or permission boundaries. In an agent environment, missing allowed-tools/permissions makes filesystem and shell access implicit and harder to audit, increasing the risk of unintended file modification or broader workspace impact.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

The skill repeatedly describes optimization, backup, rollback, extraction, and creation of new skills, all of which imply file writes or workspace alteration, but it does not place a clear safety warning near usage instructions. In context-management skills, this omission is dangerous because users may trigger potentially destructive operations without understanding that files can be rewritten or new artifacts created.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The manifest description and the instructional content are written entirely in Chinese, with no indication that the skill can operate in the user's preferred language or that it is intentionally restricted to a Chinese-speaking context. Under the policy, a fixed language/locale without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium
Category
Excessive Agency
Confidence
85% confidence
Finding

The presence of an auto_approve automation option indicates support for autonomous decision-making around workspace optimization actions. Even though it is set to false in the example, normalizing this capability in a file-modifying skill increases the risk that future configurations could enable unattended changes to important context files without user review.

Content

Scanner excerpt · SKILL.md (reported line 111)May include surrounding context.

yaml
automation:
  schedule: "weekly"      # 优化频率
  auto_approve: false     # 自动批准优化
  report_delivery: true   # 发送优化报告
  rollback_enabled: true  # 启用回滚机制

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The module docstring states the tool as a Chinese-language optimizer variant, and subsequent docstrings/messages are also written only in Chinese. Under the policy, forcing a specific language without user opt-in is a natural-language locale violation unless clearly justified as region-specific, which is not documented here.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The manifest describes an intelligent optimizer that analyzes, streamlines, and optimizes workspace context files and extracts reusable components into independent skills. In this file, the implementation only counts characters/lines, estimates duplicate lines, assigns a simple score, and writes text/JSON reports; it does not modify context files or extract any components.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
91% confidence
Finding

The executed workflow analyzes files, prints a report, and saves report artifacts back into the workspace. No existing context files are rewritten, condensed, or reorganized, so the code does not actually reduce token usage as the manifest claims.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

This Python file contains multiple user-facing messages and instructions exclusively in Chinese, such as usage text, prompts, status messages, and report headings. The applicable policy forbids forcing a specific language without user opt-in, and this file does not provide any mechanism for selecting another language or explain that the tool is intentionally region-specific.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The tool's stated purpose is context optimization, but this command also materializes workspace content into a new standalone skill. That expands the trust boundary and can unintentionally package sensitive instructions, secrets, or unsafe prompt content into reusable artifacts, which is riskier than simple local optimization and may surprise users expecting only analysis/refactoring.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
98% confidence
Finding

The manifest describes a skill that analyzes, simplifies, and optimizes workspace context files, including extracting reusable components as standalone skills. In this file, the implementation only reads markdown files, computes simple metrics like duplicate-rate and estimated tokens, and writes analysis reports; it does not modify context files or extract any components into skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

User-facing docstrings and printed guidance throughout the script are presented exclusively in Chinese, which imposes a locale/language choice on all users. The file does not indicate that the skill is region-specific or provide any mechanism for language selection.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill description emphasizes context optimization, but the script also installs files into ~/.openclaw/skills and modifies the user's environment. That mismatch reduces transparency and can lead users to authorize broader filesystem changes than they reasonably expect from the declared purpose.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The script writes into the user's skills directory immediately, without a confirmation prompt or dry-run mode. Silent filesystem modification is risky in an agent skill because users may not realize persistent files are being installed into trusted execution locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

This code copies an executable script into the workspace and then runs it, and also writes a report file, all without prior consent. In the context of an agent skill, automatically placing executable content into a trusted workspace and executing it can amplify the impact of tampering or user misunderstanding.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · setup_and_test.py (reported line 109)May include surrounding context.

python
# 测试分析功能
    print("1. 测试分析功能...")
    try:
        result = subprocess.run(
            [sys.executable, optimizer_script, "analyze"],
            capture_output=True,
            text=True,

Context-Inappropriate Capability

Medium
Category
Not specified by scanner
Confidence
90% confidence
Finding

The installer/test script has capability to execute local code as a subprocess, which exceeds pure 'context optimization' behavior and increases trust requirements. In this skill context, that is more dangerous because the script also copies files into user-controlled workspace locations and then executes one of them, creating a code-execution path that could run tampered content.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · setup_and_test.py (reported line 179)May include surrounding context.

python
try:
        # 检查openclaw命令是否可用
        result = subprocess.run(
            ["openclaw", "--version"],
            capture_output=True,
            text=True,

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

The manifest describes an 'intelligent context optimizer' that analyzes, simplifies, optimizes workspace context files, and extracts reusable components into standalone skills. In this file, the implementation only counts characters/lines/words, estimates duplicate rate, generates a report, and saves report files; it does not simplify content, optimize files, or extract components into skills.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low
Category
Not specified by scanner
Confidence
92% confidence
Finding

This markdown file contains user-facing instructions and examples exclusively in Chinese, starting from the title, with no indication that other languages are supported or that the language choice is intentional and documented. Under the policy rule, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.