ContextKeeper — Safe project state tracking for AI agents. Manual checkpoint creation with validated inputs. No background processes, no PID manipulation, no...

This skill appears to be a local checkpoint/dashboard tool that writes JSON checkpoint files to ~/.memory/contextkeeper and reads local git metadata. No network calls or credentials are requested, which is good. However, the README/metadata contains contradictory claims (e.g., 'No command execution' and 'requires: none') while the packaged scripts clearly run shell commands and require git/bash. Before installing or invoking: 1) Review and accept that the skill will create and write files under $HOME/.memory/contextkeeper. 2) Confirm you’re comfortable with local git metadata (file names, recent commits) being stored there. 3) If you need stronger guarantees, run the scripts in a sandboxed environment or inspect them line-by-line (they are simple shell scripts) and consider adjusting them to your policies. The mismatch between documentation claims and included scripts is the main reason for a 'suspicious' rating — likely sloppy documentation, but verify before trusting the skill for sensitive environments.

Type: OpenClaw Skill Name: contextkeeper Version: 0.2.3 The `scripts/ckpt.sh` file contains a JSON injection vulnerability. While most user-controlled inputs are passed through a `json_escape` function, the `files_touched` array is constructed from `git diff --name-only` output without individual filename escaping. An attacker could commit a file with a crafted name (e.g., `foo", "malicious_key": "injected_value`) to inject arbitrary JSON into the checkpoint files, potentially corrupting the agent's state or influencing future behavior. This is a lack of input sanitization, classifying it as suspicious rather than malicious due to the absence of direct evidence of intentional harmful behavior like data exfiltration or RCE within the provided code.