Security audit

Context Assembler

Security checks across malware telemetry and agentic risk

Overview

This skill does what it claims at a high level, but it reads private OpenClaw memory files and automatically stores raw task text in a persistent local log without clear controls.

Install only if you are comfortable with the skill reading OpenClaw memory files and injecting selected snippets into prompts. Before routine use, disable or modify the feedback log so raw task descriptions are not stored indefinitely, and avoid putting secrets, credentials, personal data, or proprietary content in task descriptions or memory notes.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (8)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 83% confidence
Finding: The skill advertises only documentation-level behavior in SKILL.md, but the associated implementation apparently reads environment variables and performs file reads/writes without declaring permissions. In an agent ecosystem, undeclared capabilities weaken operator trust and policy enforcement because a seemingly harmless context-preprocessor can access workspace data and persist logs, increasing the chance of unintended data exposure or unauthorized state changes.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This is a significant description-behavior mismatch: beyond context assembly, the skill reportedly injects persona/identity content, behavioral rules, special-case background instructions, and writes structured feedback logs. In a pre-reasoning context injector, hidden instruction shaping is especially dangerous because it can silently alter agent decision-making, bypass user expectations, and create covert prompt-layer control over future actions.

Description-Behavior Mismatch

Medium

Confidence: 96% confidence
Finding: The script persistently appends telemetry to feedback/outcomes.jsonl, including the raw task description and execution metadata, even though the skill is presented as a context preprocessor. That creates an undisclosed retention channel for potentially sensitive prompts and user activity, and the logging occurs automatically on every run without consent, minimization, or retention controls.

Vague Triggers

Medium

Confidence: 87% confidence
Finding: The invocation phrase "optimize my context" is broad enough to overlap with normal user language, which can cause accidental triggering. For a skill that modifies pre-reasoning context and possibly injects hidden instructions, unintended activation raises the risk of unanticipated agent behavior, context manipulation, and logging without clear user intent.

Missing User Warnings

Medium

Confidence: 98% confidence
Finding: The code writes the full task description to a persistent JSONL log without any user-facing disclosure or consent. Task descriptions often contain sensitive prompts, proprietary data, or personal information, so silent retention materially increases privacy and insider-access risk even if the file is only local.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The skill reads MEMORY.md, daily notes, and preferences, then injects matched content into downstream prompt context without any visible consent or disclosure boundary. In a context-assembly skill this behavior is functional, but it still creates a privacy risk because stored user notes may be surfaced unexpectedly to later model steps or outputs.

Ssd 3

Medium

Confidence: 88% confidence
Finding: The preferences.md content is scored and, if relevant, prepared for inclusion in assembled context, which can cause stored user preferences or other sensitive notes to be surfaced to downstream model processing. Because the skill's purpose is context injection, this data flow is contextually expected, but it is still a real leakage path if sensitive memory is mixed with ordinary preferences.

Ssd 3

Medium

Confidence: 95% confidence
Finding: The code automatically copies up to 300 characters of high-relevance memory text into the assembled prompt. This creates a direct natural-language leakage path from stored notes into model context and potentially into later outputs, especially if retrieval matches sensitive chunks by broad keyword heuristics.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.