T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/search_sessions.py:25- Finding
Unrestricted Cross-Agent Access to Private Session Transcripts
- Content
View full analysis
- Remediation
View remediation
Security audit
Session History
Security checks for vulnerabilities and agentic risk
Overview
The skill does what it says, but it broadly searches private prior conversation transcripts across all local agents by default without clear consent or scoping controls.
Install only if you are comfortable with the skill searching prior OpenClaw conversation transcripts on this machine, including other local agents by default. Prefer using an explicit --agent scope and avoid using it in shared or multi-user environments unless transcript access is clearly authorized.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill description encourages use whenever a user references prior discussions or asks to 'remember' something, which is broad enough to trigger transcript searches in situations where the user may not expect cross-session retrieval. Because this skill accesses historical conversation transcripts across all sessions, overly permissive activation guidance increases the chance of unnecessary access to sensitive prior context.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The skill instructs the agent to search and directly read prior session transcripts, including JSONL files under a per-agent session directory, but it provides no user-facing warning that historical conversations may be accessed. This can undermine user expectations and privacy by causing retrieval of sensitive past content without transparent notice or consent.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
This script is explicitly designed to search and print historical session transcripts, including user message previews, excerpts, timestamps, and filesystem paths, with no access control, consent check, redaction, or privacy warning. In the context of agent conversations, transcripts may contain credentials, personal data, internal URLs, or other sensitive material, so broad cross-session retrieval materially increases the risk of unintended disclosure to whoever can invoke the skill.
- Content
Static analysis
No suspicious patterns detected.