context-manager

SAFE max severity MEDIUMSkillSpector Caution 44 registry clawhub.ai last scanned 2026-02-07 1 scan

Verdict safe, but 2 findings (2 medium), mainly unauthorized tool use, data exfiltration. Most recent scan 2026-02-07.

This skill presents MODERATE security risks primarily related to indirect prompt injection and unrestricted tool access. The core vulnerability is the transitive trust model where AI-generated summaries are injected back into fresh sessions without validation, creating a potential vector for prompt injection persistence. The skill performs destructive operations (session deletion) without declaring required tools in the manifest, and stores sensitive session backups without encryption. However, the skill does not exhibit critical threats like data exfiltration to external servers or hardcoded credentials. The functionality appears legitimate for its stated purpose of context management, but requires security hardening around AI-generated content handling and backup storage.
Scanner's overall assessment (LLM analyzer)

Findings2

Critical0

High0

Medium2

Low0

Analyzersstatic llm meta

Second scanner: NVIDIA SkillSpector

VerdictCaution 44

Score44 / 100

Issues3

CategoriesTool Misuse Rogue Agent Excessive Agency

Version2.12.0 (static)

Independent static run, no language model, over the same files as the Cisco scan above. How the two scanners compare across the whole corpus: Two scanners, one corpus.

What this skill does

AI-powered context management for OpenClaw sessions

Package: 3 files, 39 KB
SKILL.md: 888 words, 12+ sections
Code: Shell (1)

SKILL.md covers: Context Manager Skill · Quick Start · List all sessions with usage stats · Check status of a specific session · Generate AI summary (read-only, safe) · Compress session: generate summary, reset, inject (DESTRUCTIVE) · When to Use · How It Works · Commands · Session Commands · Configuration Commands · Examples

Findings

MEDIUM Unrestricted Tool Access Without Declaration Unauthorized Tool Usellm

The skill does not declare 'allowed-tools' in its manifest, yet the bash script performs extensive file system operations including reading session files, writing compressed backups, deleting session files, and executing the 'openclaw' CLI tool. While 'allowed-tools' is optional, the absence of this declaration combined with destructive operations (file deletion, session reset) represents a tool exploitation risk where users cannot easily verify what capabilities the skill requires.

SKILL.md

YAML Manifest:
- allowed-tools: Not specified

But script performs:
- File reads: cat "$SESSION_FILE"
- File writes: cp "$SESSION_FILE" "$backup_file"
- File deletion: rm -f "$SESSION_FILE"
- Command execution: openclaw send

Remediation: Add 'allowed-tools: [Bash, Read, Write]' to the YAML manifest to explicitly declare required capabilities. Consider implementing a dry-run mode that shows what operations would be performed before executing destructive actions. Add user confirmation prompts before deleting session files.

MEDIUM Session File Backup Without Encryption Data Exfiltrationllm

The skill backs up session JSONL files to 'memory/compressed/' directory without encryption. Session files may contain sensitive conversation history, credentials, API keys, or other confidential information discussed during the session. Storing these backups in plaintext creates a data exposure risk if the file system is compromised or if backups are inadvertently shared.

compress.sh

backup_file="$COMPRESSED_DIR/${SESSION_KEY//:/--}_${timestamp}.jsonl"
cp "$SESSION_FILE" "$backup_file"
echo "💾 Backup saved: $backup_file"

Remediation: Implement encryption for backup files using tools like gpg or age. Add a configuration option to disable backups entirely for users who prefer not to retain session history. Document the security implications of backup storage and recommend secure file permissions (chmod 600) for the compressed directory.

What is in the package

File	Kind	Size
`SKILL.md`	doc	8.0 KB
`compress.sh`	script	31 KB
`config.json`	config	151 B

Environment variables referenced

COMPRESSED_DIR SESSION_ID SESSION_KEY CONFIG_FILE MAX_TOKENS AGENT_ID CURRENT_TOKENS OPENCLAW_STATE_DIR SESSION_MODEL

Package contents recorded 2026-10-22. The scan above ran against the version current at scan time; the two can differ if the skill has since been updated.

What we checked

Static analyzer. Pattern rules over SKILL.md and bundled files: known-bad commands, exfiltration URLs, secrets, obfuscation.
Llm analyzer. A language model reads the skill and reports intent-level issues the rules cannot express.
Meta analyzer. A second model pass that validates, deduplicates and re-scores the other analyzers' findings.

What we did not check

Runtime behaviour. The skill was not executed; findings come from reading its files.
Anything fetched at install or run time, including remote scripts, package dependencies, and URLs the skill tells the agent to open.
Content the analyzers cannot read: images, binaries, and some non-English text.
Known scanner bypass classes. See the methodology and limitations page.

Sources

Repository: https://clawhub.ai/skills/context-manager
Raw scan result: smart-context-manager-scan.json
Badge for your README: ![skillscan.io](https://skillscan.io/badge/clawhub-ai-context-manager.svg)
Request a re-scan