Security audit

Dalong Session Logs

Security checks for vulnerabilities and agentic risk

Overview

The skill openly helps search local conversation logs, but it enables broad searches across all prior session transcripts without clear consent, scoping, or redaction safeguards.

Install only if you are comfortable with an agent reading prior OpenClaw session transcripts. Use it with narrowly specified sessions, dates, or search terms, and avoid returning raw transcript excerpts that may contain secrets, personal data, tool outputs, or unrelated conversations.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:29
Finding: Unrestricted Access to Complete Historical Session Logs
Content: View full analysis
/sessions/` (default: `~/.openclaw/agents//sessions/`). Use the `agent=` value from the system prompt Runtime line. - **`sessions.json`** - Index mapping session keys to session IDs - **`.jsonl`** - Full conversation transcript per session ``` The Skill also provides an unrestricted cross-session search operation: ```markdown ### Search across ALL sessions for a phrase ```bash AGENT_ID="" SESSION_DIR="${OPENCLAW_STATE_DIR:-$HOME/.openclaw}/agents/$AGENT_ID/sessions" rg -l "phrase" "$SESSION_DIR"/*.jsonl ``` ``` ### Technical Analysis The Skill discloses the location and structure of the Agent's complete historical session storage and instructs the Agent to enumerate, search, and extract data from all session transcript files. These transcripts may contain user messages, assistant responses, tool calls, usage information, personal data, confidential business information, or credentials previously supplied during unrelated conversations. The documented operations are read-only and do not exploit an operating-system vulnerability. However, the Skill does not establish authorization or least-privilege controls before accessing unrelated sessions. It lacks: - Verification that the requesting user owns the target session. - Restriction to a specified session or authorized parent-session chain. - Explicit consent before searching complete conversation history. - Separation between providers, users, or conversation contexts. - Filtering of tool calls, internal reasoning records, credentials, or other sensitive content. - Redaction and output-volume controls before matchi ...[truncated 1599 chars]
Remediation: View remediation
" SESSION_FILE="$SESSION_DIR/$SESSION_ID.jsonl" test -f "$SESSION_FILE" && jq -r ' select(.type == "message" and .message.role == "user") | .message.content[]? | select(.type == "text") | .text ' "$SESSION_FILE" | rg --fixed-strings -- "$QUERY" ``` 10. Treat query input strictly as data by using fixed-string matching and `--` argument separation, and validate session identifiers before incorporating them into file paths. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to search complete historical session logs, which can contain sensitive prior user prompts, assistant outputs, tool results, and cost metadata, but it provides no privacy warning, access limitation, or requirement to confirm scope with the user. In this context, the danger is not remote code execution but unauthorized disclosure or over-collection of sensitive historical conversation data beyond what is necessary for the current task.
Content: No source excerpt is available for this finding.