ClawHub
Back to skill

Security audit

sessions-manager

Security checks for vulnerabilities and agentic risk

Overview

This session-management skill is mostly purpose-aligned, but its delete command can remove files outside the intended session directory if session metadata is malformed or tampered with.

Install only if you are comfortable with a local tool that can delete OpenClaw session metadata and history. Review or patch the delete path validation before use, and manually confirm the target session ID or key before running delete.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/sessions_cli.py:91
Finding

Path Traversal Enables Deletion of Files Outside the Session Directory

Content
View full analysis

Vulnerability Details

File Location: scripts/sessions_cli.py, lines 91–93
Vulnerability Type: Path traversal and insufficient path validation
Risk Level: High

Vulnerable Code:

python
session_file = SESSIONS_DIR / f"{found_data.get('sessionId', found_key)}.jsonl"
if session_file.exists():
    session_file.unlink()

Technical Analysis

The history filename is constructed from the sessionId value stored in ~/.openclaw/agents/main/sessions/sessions.json. The application treats this metadata as trusted and does not validate that the identifier is a UUID or otherwise a safe filename.

A value containing .. path components can escape SESSIONS_DIR. An absolute path can also cause pathlib to discard the intended base directory. The code neither rejects path separators nor resolves the candidate path and verifies that it remains inside the expected session directory.

The appended .jsonl extension restricts potential targets to filenames ending in .jsonl, but it does not prevent deletion outside session storage.

Attack Path

  1. An attacker or compromised local component obtains write access to ~/.openclaw/agents/main/sessions/sessions.json.

  2. The attacker creates or modifies a session record with a benign session key and a malicious sessionId, such as ../../../../path/to/target.

  3. The victim invokes:

    bash
    python3 scripts/sessions_cli.py delete <benign-session-key>

  4. The CLI finds the record by its session key.

  5. It constructs a path equivalent to:

    text
    ~/.openclaw/agents/main/sessions/../../../../path/to/target.jsonl

  6. If the resolved target exists and is writable by the current user, unlink() deletes it.

Impact Assessment

Successful exploitation allows deletion of an arbitrary existing .jsonl file accessible to the user running the CLI. This can result in loss of application data, logs, session ...[truncated 574 chars]

Remediation
View remediation

Remediation Suggestions

  1. Validate sessionId against the identifier format expected by OpenClaw. If session IDs must be UUIDs, parse them with Python's uuid.UUID and reject invalid values.

  2. Reject identifiers containing path separators, absolute paths, . components, or .. components.

  3. Resolve both the session directory and candidate history path before deletion, then verify that the candidate's parent is exactly the approved directory:

    python
    from uuid import UUID

raw_id = found_data.get("sessionId")
try:
    safe_id = str(UUID(raw_id))
except (TypeError, ValueError, AttributeError):
    raise ValueError("Invalid session ID")

base_dir = SESSIONS_DIR.resolve()
session_file = (base_dir / f"{safe_id}.jsonl").resolve()

if session_file.parent != base_dir:
    raise ValueError("Session file is outside the session directory")

if session_file.is_file():
    session_file.unlink()

  4. Consider deleting the history file before committing the metadata update, or perform both operations transactionally where possible, to avoid inconsistent state when deletion fails.

  5. Handle filesystem and malformed-JSON errors explicitly and return a nonzero exit status without partially updating session metadata.

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (4)

Tp4

High
Category
MCP Tool Poisoning
Confidence
95% confidence
Finding

The skill description promises session inspection and deletion, but the documented behavior includes filesystem deletion of metadata and history files without declaring permissions, and 'view session details' is not clearly implemented as a separate constrained capability. This mismatch can mislead users and orchestration layers about the actual risk profile, especially because deletion is destructive and affects local agent state.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
88% confidence
Finding

The README documents a destructive delete command but does not clearly warn that deletion removes session metadata and associated history files and may be irreversible. In a session-management tool, this omission can lead users to unintentionally destroy operational or forensic data, especially because session identifiers may be long and error-prone to verify manually.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
90% confidence
Finding

The skill documents commands that read session metadata and delete session files, but it declares no explicit tool scope or permissions. This creates a gap between what the skill can cause an agent to do and what users or policy systems can verify up front, increasing the chance of unintended file access or deletion.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
94% confidence
Finding

The skill provides a direct delete command for session IDs/keys and states that it removes both metadata and history files, but it gives no warning, confirmation step, or recovery guidance. In an agent setting, this raises the risk of accidental or impulsive destructive actions that can erase audit/history data needed for debugging or investigation.

Content

No source excerpt is available for this finding.