Security audit

Session Archive

Security checks for vulnerabilities and agentic risk

Overview

This is a disclosed local session-archive skill, but installing it means full conversation history can be kept on disk.

Install this only if you intentionally want a persistent local archive of OpenClaw conversations. Keep the SQLite database protected from backups or other users, avoid entering secrets in archived sessions, and plan your own deletion or retention process because the skill does not provide one.

A.I.G

Vulnerability Patterns

Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access

Findings (37)

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The plugin is explicitly designed to archive every conversation message to a local SQLite database in real time, and the code shows no consent prompt, notice, opt-in flow, redaction, or access control around that storage. Because agent conversations commonly contain secrets, personal data, API keys, or sensitive business content, silent persistent logging materially increases privacy and data exposure risk if the host is multi-user, compromised, or backed up/shared.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The agent_end hook persistently stores assistant and related conversation messages, including tool-related content and inferred metadata, without any user-facing privacy notice. This creates a durable transcript of potentially sensitive model outputs, tool interactions, and attached media references that could later be accessed by other local users, malware, backups, or operators unaware of the sensitivity.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This hook stores user messages before agent execution, meaning sensitive prompts are persisted immediately and regardless of whether downstream handling succeeds or whether the user understands logging is enabled. Persisting raw user input without visible disclosure or consent is especially risky because users often provide credentials, personal information, and proprietary data in initial prompts.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: @mariozechner/pi-coding-agent==0.63.1 — 3 advisory(ies): CVE-2026-54326 (Pi Agent: Potential XSS in HTML session exports via Markdown URL sanitization by); CVE-2026-54328 (Pi Agent: Predictable temporary extension install paths allow local privilege es); CVE-2026-54327 (Pi Agent: Race condition in Pi auth.json writes could expose stored credentials)

High

Category: Supply Chain
Confidence: 97% confidence
Finding: @mariozechner/pi-coding-agent 0.63.1 is a high-risk dependency in this context because it is an agent/coding component likely to handle session exports, temporary extension installation, and local auth state. The cited XSS, predictable temp-path, and credential-race issues align closely with likely skill behaviors, making this more dangerous than a generic library issue.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: axios==1.14.0 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more

High

Category: Supply Chain
Confidence: 94% confidence
Finding: axios 1.14.0 is a known vulnerable version with numerous advisories, including SSRF-related proxy normalization issues and prototype-pollution-based exploitation paths. In an agent ecosystem that may fetch remote resources, call APIs, or honor environment proxy settings, this substantially increases risk because attacker-controlled URLs or proxy configuration can pivot into internal network access or credential exposure.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: basic-ftp==5.2.0 — 4 advisory(ies): GHSA-6v7q-wjvx-w8wg (basic-ftp: Incomplete CRLF Injection Protection Allows Arbitrary FTP Command Exe); CVE-2026-39983 (basic-ftp has FTP Command Injection via CRLF); CVE-2026-41324 (basic-ftp vulnerable to denial of service via unbounded memory consumption in Cl) +1 more

High

Category: Supply Chain
Confidence: 90% confidence
Finding: basic-ftp 5.2.0 is flagged for FTP command injection and denial-of-service issues, which are genuine concerns when processing attacker-controlled FTP paths, commands, or responses. In an agent or automation context that may retrieve external resources, this can enable command injection against FTP sessions or service instability via malformed remote input.
Content: No source excerpt is available for this finding.

Known Vulnerable Dependency: brace-expansion==5.0.5 — 4 advisory(ies): CVE-2026-13149 (brace-expansion: DoS via exponential-time expansion of consecutive non-expanding); CVE-2026-45149 (brace-expansion: Large numeric range defeats documented `max` DoS protection); CVE-2026-14257 (brace-expansion: DoS via unbounded expansion length causing an out-of-memory pro) +1 more

High

Category: Supply Chain
Confidence: 93% confidence
Finding: brace-expansion 5.0.5 has multiple denial-of-service advisories related to pathological expansion inputs. This is particularly relevant in tooling, globbing, archiving, or agent workflows where attacker-controlled patterns may be evaluated, potentially causing CPU or memory exhaustion and disrupting the service.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The plugin is explicitly designed to archive every conversation message to a local SQLite database, including potentially sensitive user, assistant, system, and tool content. Persisting complete conversations without any visible consent, notice, opt-in, redaction, or retention controls creates a significant privacy and data-handling risk if the host device, database file, backups, or logs are accessed by unauthorized parties.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The agent_end hook persists assistant and related conversation messages, including tool metadata and possible media references, creating a durable archive of potentially sensitive prompts, outputs, and operational context. Because the code stores content broadly and does not show any disclosure, access control, redaction, or retention safeguards, compromise of the local environment could expose complete conversation history.
Content: No source excerpt is available for this finding.

Missing User Warnings

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: This hook stores user messages before agent execution, meaning sensitive inputs are captured immediately and persist even if the run fails or the user did not expect logging. In a skill context, users may provide credentials, personal data, or proprietary information, so silent pre-execution persistence materially increases privacy exposure and forensic recoverability.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The README states that every completed conversation is automatically written to a local SQLite database, including full message content and metadata, but it does not prominently communicate that this collection is on by default or emphasize the privacy sensitivity of archived conversations. In an agent/plugin context, archived messages may contain credentials, personal data, proprietary prompts, or tool outputs, so silent or poorly disclosed persistence increases the risk of unintended sensitive-data retention and later disclosure.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill states that it automatically archives conversation messages to a local SQLite database, but it does not prominently warn users about this data collection behavior or its privacy implications. Silent persistence of all chat content can expose sensitive prompts, credentials, personal data, or proprietary information to other local users, backups, malware, or later unintended access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 87% confidence
Finding: This code creates and initializes a local SQLite database, and later inserts message content, account identifiers, media paths, operation targets, and token-usage metadata into it. Although the persistence is clear from the implementation, there is no visible confirmation prompt, user-facing log/print, or explanatory comment warning that user and system activity will be archived to disk.
Content: No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The engine persists full message content plus metadata such as accountId, toolName, message IDs, and media paths, which exceeds a narrowly scoped archival need and increases exposure of sensitive user and system data. If the archive database is later queried, breached, or reused for analytics, this over-collection materially expands privacy, confidentiality, and secondary-use risk.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The code stores session content and metadata without any visible consent, notice, or policy enforcement at the point of collection. In a session archive skill, this is especially sensitive because users may reasonably assume ephemeral processing, while the implementation silently creates durable records that can include personal data and operational traces.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The package manifest states that the plugin performs real-time archival of conversations and operations to SQLite, but the description does not clearly warn users that potentially sensitive interaction data will be continuously stored. In an agent/plugin context, silent or under-disclosed logging increases privacy and data-handling risk because users or operators may enable the skill without understanding the persistence behavior.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: This module persistently stores full session messages, operation history, and token-usage data to a database in the user's home directory, including potentially sensitive content such as prompts, system messages, commands, file targets, account identifiers, and media paths. In this file there are no visible controls for consent, minimization, encryption, retention, or access restriction, so sensitive local data may be collected and retained longer than expected and exposed to other local processes or users.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: recordOperation stores targets, details, results, and operator data verbatim, and details are serialized without any filtering or indication that potentially sensitive actions will be archived. Operational logs in agent systems often capture commands, resource identifiers, and secret-bearing parameters, so retaining them broadly can expose sensitive activity to anyone with database access.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The engine persists full session message contents plus rich metadata such as account IDs, message IDs, tool names, media paths, and token data without any visible consent, minimization, or access-control safeguards in this component. In an agent context, archived conversations commonly contain secrets, personal data, and sensitive operational context, so silent retention increases privacy and breach impact even if the code is not overtly malicious.
Content: No source excerpt is available for this finding.

Ssd 3

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: The plugin’s stated purpose and implementation semantically direct persistent collection of all conversation content into an archive, which is privacy-sensitive by design. While the apparent goal is archival rather than exfiltration, the context makes this dangerous because agent conversations often contain secrets, personal data, or business-sensitive material, and the code does not demonstrate consent or minimization measures.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 90% confidence
Finding: The natural-language content of the skill description and usage instructions is presented exclusively in Chinese, with no indication that the user can choose another language or that the skill is intended only for a Chinese-language context. This may violate language/locale policy requirements when no opt-in or justification is provided.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: The file contains natural-language comments in Chinese, such as the metadata-field note, which imposes a specific language in the skill artifacts without offering any language choice or documenting a locale-specific reason. Under the stated policy, forced language/locale in natural-language content is a violation unless users are given an option or the locale restriction is justified.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 92% confidence
Finding: This line includes a Chinese comment describing the operations table, again embedding a fixed language choice in the skill file. No accompanying documentation indicates that the skill is region-specific or that maintainers may choose another language, so it conflicts with the language/locale policy.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The natural-language comment on this line is written in Chinese and does not provide any opt-in or stated regional justification. That makes the file's natural-language guidance depend on a single locale, which the policy says to avoid unless documented and justified.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 85% confidence
Finding: recordOperation persists operation targets and serialized details, which may include user or system data, but this file shows no visible confirmation, notice, or warning to the user that their actions are being logged. Because audit logging can capture sensitive context, some disclosure is expected unless clearly documented elsewhere.
Content: No source excerpt is available for this finding.