Security audit
Security checks for vulnerabilities and agentic risk
This skill does what it says by archiving sessions, but it silently persists conversation content, modifies future agent startup instructions, and can delete shared memory files without clear user control.
Install only if you intentionally want automatic, silent archiving of OpenClaw conversations into workspace memory. Review or remove the AGENTS.md self-integration behavior, disable or constrain cleanup, and avoid using it in workspaces where chats may include credentials, private records, confidential code, or sensitive business data.
scripts/session-auto-archive.js:129Untrusted Transcript Content Is Persisted into Agent Memory
scripts/session-auto-archive.js:29Automatic Modification of Persistent Agent Startup Instructions
scripts/session-auto-archive.js:220Silent Duplication of Sensitive Main-Agent Conversation Data
scripts/session-auto-archive.js:181Cleanup Can Delete Unrelated Date-Named Memory Files
The skill is presented as a session archiver, but it additionally performs a persistence/integration action by auto-appending startup instructions into AGENTS.md. Self-installing into agent startup flows expands execution reach and persistence beyond the stated archival purpose, making the behavior materially more dangerous in context.
The skill is presented as a session archiver, but it additionally performs a persistence/integration action by auto-appending startup instructions into AGENTS.md. Self-installing into agent startup flows expands execution reach and persistence beyond the stated archival purpose, making the behavior materially more dangerous in context.
The skill is designed to retain user and assistant message content from completed sessions and append it into memory automatically, with silent execution and future reuse. In context, this is dangerous because it creates a secondary long-lived store of conversational data without clear user awareness, increasing exposure of sensitive information and violating data-minimization expectations.
The documentation normalizes silent hourly archival and silent /new-triggered background processing of conversation data without clear user warning or consent. Because the archived data includes user and assistant messages and is stored for later reuse, the lack of disclosure creates a significant privacy and data-governance risk.
The workflow goes beyond archival and analyzes conversations to extract reusable preferences, decisions, lessons, and workflow changes for future sessions. This transforms raw chats into behavioral profiles and persistent memory artifacts, which materially increases privacy risk and the chance of unintended influence or leakage in later interactions.
The skill declares no explicit tool scope or permissions despite describing behavior that reads session transcripts, writes memory files, modifies AGENTS.md, and deletes old files. Missing scope boundaries increases the chance that an agent executes the skill with broader filesystem/environment access than users expect, reducing containment and auditability.
The substantive skill instructions and behavior description are written in Chinese, while the surrounding audit context is English and there is no indication that Chinese is required or user-selected. This creates a language/locale constraint without opt-in or documented justification.
The skill advertises automatic cleanup that deletes memory files older than 30 days, but this destructive behavior is not surfaced as a prominent warning with recovery implications. Automatic deletion can cause unintended data loss, especially when users may not realize the skill manages retention autonomously.
The skill explicitly says no manual action is required and that it will automatically detect and append integration content to AGENTS.md, but it does not present this as a user-facing warning or consent boundary. Silent modification of agent control files creates persistence and trust risks because future sessions may invoke behavior the user never knowingly enabled.
The manifest says the skill automatically archives completed sessions by extracting meaningful user and assistant messages from .reset transcript files and appending them to daily memory. This script instead builds an .insights-candidates-<date>.md report for later manual review, and never appends extracted messages into an existing daily memory archive.
The script modifies AGENTS.md on disk to insert new workflow instructions that go beyond simple session archiving. Self-integrating into agent instructions creates an unauthorized persistence and behavior-expansion mechanism: once executed, the skill changes future agent behavior without explicit user approval, which is dangerous in a system that treats AGENTS.md as instruction-bearing state.
The script automatically deletes memory files older than 30 days without an explicit warning, backup step, or user-configurable retention confirmation. While this is primarily an integrity/availability concern rather than code execution, it can still cause silent loss of records that users may rely on for auditability or recall.
The script persists raw user and assistant text from session transcripts into memory files with only minimal metadata stripping and no meaningful sensitive-data detection. In the context of an archiver operating on entire session transcripts, this materially increases the risk of long-term storage of secrets, personal data, internal code, tokens, or other confidential content, making later exposure or misuse more damaging.
The script appends meaningful user and assistant transcript content into persistent memory files without any explicit notice or consent at the time of storage. Because it archives free-form conversation text, it can silently retain secrets, personal data, credentials, or sensitive project information beyond the original session lifecycle.
The skill performs a second function—extracting and storing 'insight candidates'—in addition to the declared archiving role. Even though it avoids subprocesses and says human review is required, it still derives behavioral/profile data from conversations and persists it, broadening data collection and creating a secondary memory artifact that may influence future actions.
The file header states that extracted insights are output to .insights-candidates.md for review in self-improving, implying a destination associated with the self-improving area. However, the actual output path is constructed under WORKSPACE/memory via CANDIDATES_FILE, while SELF_IMPROVING_DIR is defined but unused, so the documentation contradicts runtime behavior.
The generated report timestamp is hard-coded to use the 'zh-CN' locale and 'Asia/Shanghai' timezone. This is a natural-language/locale policy concern because the skill imposes a specific locale in user-facing output without offering a choice or documenting why this locale is required.
The generated insights header uses toLocaleString('zh-CN', { timeZone: 'Asia/Shanghai' }), forcing a specific language/locale and timezone in output. This can violate language/locale policy when users have not opted into Chinese output and no region-specific justification is documented in the file.
No suspicious patterns detected.