{
  "skill_name": "context-manager",
  "skill_path": "/workspace/skills/clawhub-context-manager",
  "skill_directory": "/workspace/skills/clawhub-context-manager",
  "is_safe": true,
  "max_severity": "MEDIUM",
  "findings_count": 2,
  "findings": [
    {
      "id": "llm_finding_context-manager_1",
      "rule_id": "LLM_UNAUTHORIZED_TOOL_USE",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Unrestricted Tool Access Without Declaration",
      "description": "The skill does not declare 'allowed-tools' in its manifest, yet the bash script performs extensive file system operations including reading session files, writing compressed backups, deleting session files, and executing the 'openclaw' CLI tool. While 'allowed-tools' is optional, the absence of this declaration combined with destructive operations (file deletion, session reset) represents a tool exploitation risk where users cannot easily verify what capabilities the skill requires.",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": "YAML Manifest:\n- allowed-tools: Not specified\n\nBut script performs:\n- File reads: cat \"$SESSION_FILE\"\n- File writes: cp \"$SESSION_FILE\" \"$backup_file\"\n- File deletion: rm -f \"$SESSION_FILE\"\n- Command execution: openclaw send",
      "remediation": "Add 'allowed-tools: [Bash, Read, Write]' to the YAML manifest to explicitly declare required capabilities. Consider implementing a dry-run mode that shows what operations would be performed before executing destructive actions. Add user confirmation prompts before deleting session files.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents MODERATE security risks primarily related to indirect prompt injection and unrestricted tool access. The core vulnerability is the transitive trust model where AI-generated summaries are injected back into fresh sessions without validation, creating a potential vector for prompt injection persistence. The skill performs destructive operations (session deletion) without declaring required tools in the manifest, and stores sensitive session backups without encryption. However, the skill does not exhibit critical threats like data exfiltration to external servers or hardcoded credentials. The functionality appears legitimate for its stated purpose of context management, but requires security hardening around AI-generated content handling and backup storage.",
        "primary_threats": [
          "Indirect Prompt Injection",
          "Tool Exploitation",
          "Data Exposure",
          "Resource Exhaustion"
        ],
        "aitech": "AITech-12.1",
        "aitech_name": "Tool Exploitation",
        "aisubtech": "AISubtech-12.1.2",
        "aisubtech_name": "Tool Poisoning",
        "scanner_category": "SUSPICIOUS CODE EXECUTION",
        "meta_validated": true,
        "meta_confidence": "HIGH",
        "meta_confidence_reason": "The skill's functionality is clearly documented and matches its implementation. All file operations are on local session files within the OpenClaw state directory. No external network calls or credential theft. This is a transparency/documentation issue, not a security threat.",
        "meta_exploitability": "None - This is a documentation gap, not an exploitable vulnerability",
        "meta_impact": "Low - Users cannot easily verify required capabilities from manifest alone"
      }
    },
    {
      "id": "llm_finding_context-manager_3",
      "rule_id": "LLM_DATA_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Session File Backup Without Encryption",
      "description": "The skill backs up session JSONL files to 'memory/compressed/' directory without encryption. Session files may contain sensitive conversation history, credentials, API keys, or other confidential information discussed during the session. Storing these backups in plaintext creates a data exposure risk if the file system is compromised or if backups are inadvertently shared.",
      "file_path": "compress.sh",
      "line_number": null,
      "snippet": "backup_file=\"$COMPRESSED_DIR/${SESSION_KEY//:/--}_${timestamp}.jsonl\"\ncp \"$SESSION_FILE\" \"$backup_file\"\necho \"\ud83d\udcbe Backup saved: $backup_file\"",
      "remediation": "Implement encryption for backup files using tools like gpg or age. Add a configuration option to disable backups entirely for users who prefer not to retain session history. Document the security implications of backup storage and recommend secure file permissions (chmod 600) for the compressed directory.",
      "analyzer": "llm",
      "metadata": {
        "model": "claude-sonnet-4-5-20250929",
        "overall_assessment": "This skill presents MODERATE security risks primarily related to indirect prompt injection and unrestricted tool access. The core vulnerability is the transitive trust model where AI-generated summaries are injected back into fresh sessions without validation, creating a potential vector for prompt injection persistence. The skill performs destructive operations (session deletion) without declaring required tools in the manifest, and stores sensitive session backups without encryption. However, the skill does not exhibit critical threats like data exfiltration to external servers or hardcoded credentials. The functionality appears legitimate for its stated purpose of context management, but requires security hardening around AI-generated content handling and backup storage.",
        "primary_threats": [
          "Indirect Prompt Injection",
          "Tool Exploitation",
          "Data Exposure",
          "Resource Exhaustion"
        ],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "scanner_category": "SECURITY VIOLATION",
        "meta_validated": true,
        "meta_confidence": "MEDIUM",
        "meta_confidence_reason": "This is a best practice recommendation rather than a critical vulnerability. The backups are local-only and serve a legitimate recovery purpose. The risk depends on the sensitivity of session content and filesystem access controls.",
        "meta_exploitability": "Low - Requires local filesystem access to the user's OpenClaw directory",
        "meta_impact": "Low - Backups are local-only, no external transmission"
      }
    }
  ],
  "scan_duration_seconds": 38.221012353897095,
  "duration_ms": 38221,
  "analyzers_used": [
    "static_analyzer",
    "llm_analyzer",
    "meta_analyzer"
  ],
  "timestamp": "2026-02-07T19:34:40.397827"
}