Session History
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: session-history Version: 1.0.0 The `scripts/search_sessions.py` file appears benign, performing its stated function of searching OpenClaw session transcripts within expected directories (`~/.openclaw/agents/*/sessions/`) without evidence of malicious intent or direct vulnerabilities like path traversal or arbitrary code execution. However, the `SKILL.md` file contains an instruction for the AI agent: 'If `sessions_history` doesn't work (old/closed sessions), read the JSONL file directly with `read`'. While the script itself outputs paths strictly within the OpenClaw session directories, this explicit instruction to use a generic `read` tool, combined with the script outputting full file paths, introduces a prompt injection vulnerability. An attacker could potentially leverage this instruction to trick the agent into reading arbitrary sensitive files if they can manipulate the agent's context or subsequent prompts, even if the initial paths from the script are safe. This constitutes a risky capability without clear malicious intent, classifying it as suspicious.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing this skill allows the agent to search and read past local OpenClaw conversations when trying to recall prior work.
The skill intentionally retrieves prior conversation transcripts, which may contain sensitive user information or old instructions. This is aligned with the skill's purpose and is partially mitigated by the instruction to summarize rather than dump raw transcripts.
Search through past OpenClaw session transcripts (JSONL files in `~/.openclaw/agents/*/sessions/`). ... If `sessions_history` doesn't work ... read the JSONL file directly with `read`
Use it only if you are comfortable with the agent accessing past transcript content, and avoid treating old transcript instructions as automatically authoritative.