Security audit

Session Guardian — Never Lose a Conversation Again

Security checks for vulnerabilities and agentic risk

Overview

The skill mostly fits a session-backup purpose, but it keeps scheduled access to all agent conversations and can delete or restore session files despite read-only and local-only security claims.

Install only if you are comfortable with a skill that repeatedly reads and stores all OpenClaw agent conversations. Review the cron entries, avoid enabling the daily OpenClaw summary unless you accept model-provider and delivery-channel exposure, restrict backup directory permissions, and do not run the health-check cleanup or restore features on important sessions without an independent backup.

A.I.G

Vulnerability Patterns

Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
System PersistenceInstalls backdoors, hooks, services, or scheduled tasks that survive the run
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions

Findings (7)

T06 · System Persistence

Warning

Location: scripts/install.sh:69
Finding: Persistent Cron Jobs Execute Mutable Skill Scripts Indefinitely
Content: View full analysis
/tmp/crontab.backup 2>/dev/null || true # Add new tasks (crontab -l 2>/dev/null || true; cat << EOF # Session Guardian # Incremental backup */$INCREMENTAL_INTERVAL * * * * bash "$SKILL_DIR/scripts/incremental-backup.sh" >> "$LOG_FILE" 2>&1 # Hourly snapshot 0 */$HOURLY_INTERVAL * * * bash "$SKILL_DIR/scripts/hourly-snapshot.sh" >> "$LOG_FILE" 2>&1 EOF ) | crontab - fi ``` ### Technical Analysis The installer registers two user-level cron jobs that survive the installation process and execute scripts directly from the skill directory. Scheduled execution is related to the declared automatic-backup functionality and requires explicit confirmation, so persistence itself is functionally justified and does not obtain root privileges. However, the implementation lacks several controls expected for safe persistent execution: - There is no check for existing Session Guardian entries before appending new ones. - Re-running the installer can create duplicate jobs. - No uninstall or managed removal command is provided. - The scripts are executed from a mutable workspace path without integrity verification. - The crontab backup uses the predictable shared path `/tmp/crontab.backup`. - The installer does not create a narrowly scoped wrapper or verify ownership and permissions before each scheduled run. This means any process that can later modify the skill scripts gai ...[truncated 1115 chars]
Remediation: View remediation

T04 · Embedded Malicious Code

Error

Location: scripts/health-check.sh:42
Finding: Health Check Deletes Active Session Files Even When Backup Fails
Content: View full analysis
/dev/null || true # Delete original file rm "$session_file" ((total_cleaned++)) log " Cleaned and backed up" fi done ``` ### Technical Analysis When a session exceeds the configured threshold, the health check copies it to a backup directory and then deletes the active session. The copy operation explicitly suppresses errors with `2>/dev/null || true`, so deletion proceeds even when: - The backup volume is full. - The destination is unavailable. - Permissions prevent the copy. - The source changes during copying. - The copied file is truncated or otherwise incomplete. No checksum, size comparison, atomic rename, file lock, or successful-copy condition is required before deletion. The script also describes the result as “backed up” regardless of whether the copy succeeded. This behavior directly contradicts the security claim in `SKILL.md` that the skill “does not modify your session files — only reads and copies.” ### Attack Path 1. An agent session grows beyond the configured 5 MB threshold. 2. The backup destination becomes unwritable or runs out of space. 3. The user or an automated job runs `health-check.sh`. 4. ...[truncated 756 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/plan-manager.sh:60
Finding: Unvalidated Task Names Permit Workspace Path Traversal and File Modification
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/restore.sh:178
Finding: Restore Accepts Traversal Paths and Extracts Archives Without Validation
Content: View full analysis
/dev/null | head -1 | xargs basename | sed 's/.tar.gz$//') fi local snapshot_file="$HOURLY_DIR/$TIMESTAMP.tar.gz" if [ ! -f "$snapshot_file" ]; then echo "Snapshot does not exist: $snapshot_file" exit 1 fi local temp_dir="/tmp/session-guardian-restore-$$" mkdir -p "$temp_dir" if [ "$DRY_RUN" = true ]; then tar -tzf "$snapshot_file" | head -10 else tar -xzf "$snapshot_file" -C "$temp_dir" ``` The daily restore path has the same extraction issue: ```bash local archive_file="$daily_dir/$DATE.tar.gz" local temp_dir="/tmp/session-guardian-restore-$$" mkdir -p "$temp_dir" tar -xzf "$archive_file" -C "$temp_dir" ``` ### Technical Analysis `TIMESTAMP` and `DATE` are command-line inputs used directly in paths. They are not validated against the documented formats. Traversal components can therefore cause lookup outside the configured backup directories. More importantly, archives are extracted with `tar -xzf` without first validating member paths or link entries. A malicious or modified archive may contain: - Absolute paths. - `../` traversal components. - Symbolic links followed by files written through those links. - Hard links targeting files outside the extraction directory. - Unexpected device or special entries, depending on tar behavior and platform. Some tar implementations reject or sanitize basic absolute and parent paths, but the script does not enforce portable safety and does not protect against all link-based archive attacks. The temporary directory is also predic ...[truncated 1124 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/install.sh:114
Finding: Dynamic Eval Executes Configuration Values as Shell Syntax
Content: View full analysis
Remediation: View remediation

other

Warning

Location: SKILL.md:190
Finding: Security Documentation Misrepresents External Conversation Processing and Session Mutation
Content: View full analysis
/dev/null || true rm "$session_file" ``` ### Technical Analysis The daily summary is optional and requires installer confirmation, but the security documentation states categorically that no external services or network requests are used. The configured OpenClaw model is expected to process a prompt requesting analysis of all daily conversations, and delivery is configured to announce the result through the last-used channel. The documentation also states that session files are only read and copied, while the health check deletes oversized active sessions. These discrepancies prevent users from making an informed decision about confidentiality and data-loss risk. Using the “last” delivery channel can additionally route a sensitive cross-agent summary to a channel whose audience differs from the conversations summarized. ### Attack Path 1. The user relies on the stat ...[truncated 1066 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/incremental-backup.sh:36
Finding: Sensitive Conversation Backups and Extracted Knowledge Lack Explicit Permission and Encryption Controls
Content: View full analysis
/dev/null; then ((success_count++)) fi done done # Back up cron run records if [ -d "$HOME/.openclaw/cron/runs" ]; then rsync -a --timeout=10 "$HOME/.openclaw/cron/runs/"*.jsonl \ "$INCREMENTAL_DIR/" 2>/dev/null || true fi ``` `scripts/knowledge-extractor.sh`, lines 17-26, also writes raw matching JSON lines to plaintext files: ```bash local output_dir="$KNOWLEDGE_DIR/$agent_name" mkdir -p "$output_dir" cat "$session_dir"/*.jsonl 2>/dev/null | grep "✅" | tail -20 > "$output_dir/best-practices.txt" cat "$session_dir"/*.jsonl 2>/dev/null | grep "❌" | tail -20 > "$output_dir/common-issues.txt" ``` ### Technical Analysis The skill copies every agent's session history and cron-run JSONL records into a centralized workspace directory. It does not set `umask 077`, explicitly set directory modes to `0700`, or enforce file modes of `0600`. The knowledge extractor writes entire raw JSON lines selected only by emoji markers. A matching line can include metadata and unrelated sensitive content beyond the intended “best practice” or “issue.” Although `config.sh` contains `ENCRYPTION_ENABLED=false` and a GPG key ...[truncated 1348 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Tool MisuseTool Parameter Abuse, Chaining Abuse, Unsafe Defaults
Rogue AgentSelf-Modification, Session Persistence
YARA SignaturesMalware Match, Webshell Match, Cryptominer Match
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection

Findings (104)

YARA rule 'backdoor_persistence': Backdoor persistence with malicious payloads (shell commands, SSH key injection, hidden root users) [malware]

High

Category: YARA Match
Confidence: 75% confidence
Finding: YARA rule matched a known malware signature (reverse shell, backdoor, ransomware, C2 framework, or info stealer).
Content: Scanner excerpt · CHANGELOG.md (reported line 19)May include surrounding context.
md
h`） - GatewayRestart 强制恢复：自动恢复未完成任务 - 健康检查：自动清理过大 session 文件（>1MB）、修复配置、恢复任务 - 增量备份：每5分钟自动备份，最多丢失5分钟数据 - 快照备份：每小时完整备份，可恢复到任意时刻 - 智能总结：每日 AI 总结，提取关键对话、决策、成果 - 一键安装脚本：自动配置 crontab 和 OpenClaw cron - 恢复脚本：支持从增量备份、快照、每日总结恢复 - 完整文档：SKILL.md、EXAMPLES.md、RELEASE-v1.0.md - 使用示例：实战案例和常见问题解答 ### Technical Details - 基于 Lobster Studio 多智能体军团协作的实战经验 - 零 Token 成本（备份和快照不调用 LLM） - 完全独立运行（使用系统 crontab） - 自动清理和磁盘空间管理 - 向后兼容（未来版本升级无需修改配置） [1.0.0]: https://github.com/cyber-axin/session-guardian/releases/tag/v1.0.0

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: This mismatch says the skill mainly performs session isolation auditing and scans agent directories or policy files while claiming backup and recovery. That means the real data access scope may be broader and different from user expectations, increasing privacy exposure while failing to deliver the advertised safety function. Hidden or inaccurate data-access behavior is dangerous in any tool handling conversation histories.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This mismatch says the skill mainly performs session isolation auditing and scans agent directories or policy files while claiming backup and recovery. That means the real data access scope may be broader and different from user expectations, increasing privacy exposure while failing to deliver the advertised safety function. Hidden or inaccurate data-access behavior is dangerous in any tool handling conversation histories.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This mismatch says the skill mainly performs session isolation auditing and scans agent directories or policy files while claiming backup and recovery. That means the real data access scope may be broader and different from user expectations, increasing privacy exposure while failing to deliver the advertised safety function. Hidden or inaccurate data-access behavior is dangerous in any tool handling conversation histories.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 92% confidence
Finding: This mismatch says the skill mainly performs session isolation auditing and scans agent directories or policy files while claiming backup and recovery. That means the real data access scope may be broader and different from user expectations, increasing privacy exposure while failing to deliver the advertised safety function. Hidden or inaccurate data-access behavior is dangerous in any tool handling conversation histories.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: This mismatch says the skill mainly performs session isolation auditing and scans agent directories or policy files while claiming backup and recovery. That means the real data access scope may be broader and different from user expectations, increasing privacy exposure while failing to deliver the advertised safety function. Hidden or inaccurate data-access behavior is dangerous in any tool handling conversation histories.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 99% confidence
Finding: This mismatch says the skill mainly performs session isolation auditing and scans agent directories or policy files while claiming backup and recovery. That means the real data access scope may be broader and different from user expectations, increasing privacy exposure while failing to deliver the advertised safety function. Hidden or inaccurate data-access behavior is dangerous in any tool handling conversation histories.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: This mismatch says the skill mainly performs session isolation auditing and scans agent directories or policy files while claiming backup and recovery. That means the real data access scope may be broader and different from user expectations, increasing privacy exposure while failing to deliver the advertised safety function. Hidden or inaccurate data-access behavior is dangerous in any tool handling conversation histories.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: This mismatch says the skill mainly performs session isolation auditing and scans agent directories or policy files while claiming backup and recovery. That means the real data access scope may be broader and different from user expectations, increasing privacy exposure while failing to deliver the advertised safety function. Hidden or inaccurate data-access behavior is dangerous in any tool handling conversation histories.
Content: No source excerpt is available for this finding.

Anti-Refusal Statement

High

Category: Anti-Refusal
Confidence: 80% confidence
Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.
Content: Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.
md
- 🔴 **Token overflow** → session too large, agent slows down or crashes - 🔴 **Disk issues** → session files corrupted or lost No built-in backup. No recovery. No warning before it's too late. ## The Fix

Tool Parameter Abuse

High

Category: Tool Misuse
Confidence: 95% confidence
Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
Content: Scanner excerpt · scripts/hourly-snapshot.sh (reported line 43)May include surrounding context.
sh
# 压缩快照 cd "$HOURLY_DIR" tar -czf "$TIMESTAMP.tar.gz" "$TIMESTAMP/" 2>/dev/null || true rm -rf "$TIMESTAMP/" # 统计 snapshot_size=$(du -sh "$TIMESTAMP.tar.gz" 2>/dev/null | cut -f1)

Description-Behavior Mismatch

High

Category: Not specified by scanner
Confidence: 99% confidence
Finding: The script is marketed as session backup, recovery, and health monitoring, but it actually performs unrelated task-plan file management. This mismatch can cause operators to rely on the skill for resilience and data protection that it does not provide, creating a dangerous false sense of safety and likely loss of important session data after crashes or restarts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The document describes automatic backups, collaboration tracking, and knowledge extraction across multiple agents, but it provides no user-facing notice, consent flow, retention policy, or privacy boundary. Because session data can contain sensitive prompts, credentials, business context, or personal data, silently centralizing and extracting it increases the risk of over-collection, unintended disclosure, and policy noncompliance.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest frames this skill as protecting sessions through backup, recovery, and health monitoring. This changelog documents a broader shift to protecting an entire multi-agent collaboration network, adding collaboration graphing, knowledge extraction, and even automatic repair of agent model configuration, which materially exceeds the described session-protection scope.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The changelog states that temporary subagent data is aggressively cleaned based on size and retention policy, but it provides no user warning or safeguard against deleting valuable session state. In a session-protection skill, silent automated deletion undermines user expectations and can cause irreversible loss of operational context or audit history.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: Automatic extraction of 'best practices' and 'common problems' from sessions into a knowledge base can copy sensitive prompts, secrets, internal procedures, or personal data into a new storage location without informed consent. This increases exposure, retention, and secondary-use risk, especially because the skill is intended to aggregate and preserve conversational content across agents and sessions.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · EXAMPLES.md (reported line 46)May include surrounding context.
bash
# 查看系统 crontab crontab -l | grep session-guardian # 输出示例： # */5 * * * * bash /path/to/incremental-backup.sh

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · README.md (reported line 220)May include surrounding context.
bash
# 查看系统 crontab crontab -l | grep session-guardian # 输出示例： # */5 * * * * bash /path/to/incremental-backup.sh

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · RELEASE-v1.0.md (reported line 123)May include surrounding context.
bash
# 查看系统 crontab crontab -l | grep session-guardian # 输出示例： # */5 * * * * bash /path/to/incremental-backup.sh

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/install.sh (reported line 66)May include surrounding context.
sh
```bash # 查看系统 crontab crontab -l | grep session-guardian # 输出示例： # */5 * * * * bash /path/to/incremental-backup.sh

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/install.sh (reported line 80)May include surrounding context.
sh
```bash # 查看系统 crontab crontab -l | grep session-guardian # 输出示例： # */5 * * * * bash /path/to/incremental-backup.sh

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/status.sh (reported line 112)May include surrounding context.
sh
```bash # 查看系统 crontab crontab -l | grep session-guardian # 输出示例： # */5 * * * * bash /path/to/incremental-backup.sh

Session Persistence

Medium

Category: Rogue Agent
Confidence: 85% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · scripts/status.sh (reported line 114)May include surrounding context.
sh
```bash # 查看系统 crontab crontab -l | grep session-guardian # 输出示例： # */5 * * * * bash /path/to/incremental-backup.sh

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The manifest describes a skill focused on protecting OpenClaw sessions through backup, recovery, and health monitoring. This examples file documents a substantial separate capability for creating, updating, listing, archiving, and cleaning project plan files, which is not an obvious implementation detail of session protection and materially broadens the skill's behavior.
Content: No source excerpt is available for this finding.

Session Persistence

Medium

Category: Rogue Agent
Confidence: 60% confidence
Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
Content: Scanner excerpt · EXAMPLES.md (reported line 373)May include surrounding context.
bash
# 1. 创建项目计划 bash scripts/plan-manager.sh create "智能巡检产品v1.0" # 2. 编辑计划文件 vim temp/智能巡检产品v1.0-plan.md

Static analysis

No suspicious patterns detected.