Session Context Compressor

• Outcome: Review
• Latest audit: Sep 10, 2026 · 6:18 PM UTC
• Version: 1.0.0

Overview

This session-compression skill mostly matches its purpose, but it needs review because it can rewrite privileged session context and silently use Google credentials to update a Sheet when local config is present.

Install only if you are comfortable with a tool that rewrites OpenClaw session history. Review or remove the Google Sheets code unless you explicitly want remote metrics, and use dry-run plus your own backups before applying compression to important sessions.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (4)

T01 · Skill Instruction Hijacking

Error

• Location: scripts/compress.py:143

Finding

Untrusted Conversation Content Is Promoted to a Privileged System Message

Content

View full analysis

Remediation

View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/compress.py:263

Finding

Compression Implicitly Loads OAuth Credentials and Performs Authenticated Network Operations

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/compress.py:176

Finding

Backup Replacement and Non-Atomic Session Writes Can Cause Irrecoverable Data Loss

Content

View full analysis

.backup` path. On systems where `os.rename` replaces an existing destination, a second compression can overwrite the previous backup, eliminating the earlier recovery point. After moving the original session, the script opens the active session path directly and writes records sequentially. The replacement is not atomic. A process crash, disk-full condition, serialization error, interruption, or power failure can leave the active session absent or partially written. Restoration also renames the backup directly over the target without first preserving the current file. The implementation therefore doe ...[truncated 1224 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Note

• Location: config.yaml:14

Finding

Installation Instructions Use Unpinned Third-Party Dependencies and Mutable Resources

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (13)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The declared purpose is local session compression, but the finding indicates additional behaviors including writing separate tracking files and using Google Sheets API with local credentials for telemetry. Undisclosed external reporting is a serious security concern because session summaries may contain sensitive conversation data, secrets, or user content that could be exfiltrated to third parties without informed consent.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill’s stated purpose is local session compression, but it conditionally initializes Google Sheets access, reads a spreadsheet ID and OAuth credentials, and performs remote updates. That is a material capability expansion beyond the declared function and creates an unexpected outbound data path tied to local credential material.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

Although the current Google Sheets payload contains metrics rather than raw summaries, the compression workflow handles sensitive conversation-derived data and adds an external reporting channel under benign analytics framing. In this context, any unjustified remote sink attached to sensitive session processing increases the risk of disclosure and normalizes outbound transfer in a tool users would expect to remain local.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Google Sheets API integration is not necessary for compressing local session files and introduces networked exfiltration capability into a tool that otherwise appears local-only. Even though the current payload is metrics-oriented, the added API surface and credentialed remote access materially increase risk and violate least privilege.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The script accesses OAuth credential material from a fixed local path, giving a session utility the ability to leverage authenticated Google API access. Even without stealing or printing the secrets, this is credential usage outside the core function and expands the blast radius if the tool is misused or modified.

Content

Scanner excerpt · scripts/compress.py (reported line 302)May include surrounding context.

python

return  # Google libs not available
            
            # Load credentials
            creds_file = os.path.expanduser("~/.openclaw/workspace/config/google_credentials.json")
            if not os.path.exists(creds_file):
                return

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The README advertises an --apply mode that appears to modify session or context data, but it does not warn users that this action may alter or overwrite conversation state. In a tool specifically designed to compress and rewrite session history, that omission increases the chance of accidental destructive use, loss of important context, or corruption of state that later affects model behavior.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence

Finding

The skill documentation describes operations that read, modify, back up, and restore local session files, but it does not declare any explicit tool scope or permissions boundary. That omission creates a trust gap: a user or orchestrator cannot easily tell that the skill needs file read/write access, increasing the chance of unintended file modification or abuse if the implementation touches broader paths than expected.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The description says the skill triggers on 'mentions of session compression, token reduction, context cleanup' and 'when session size exceeds safe thresholds,' but it does not define specific invocation phrases, boundaries, or exclusion conditions. Terms like 'context cleanup' and generic 'mentions' are broad enough to overlap with ordinary discussion about performance or token usage, which could cause unintended activation.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The SessionCompressor initializes with lang="french" and uses that value to construct the tokenizer, imposing a specific language setting by default. The file does not offer the user a language choice or explain why French is required, which conflicts with the locale-policy requirement.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/compress.py (reported line 152)May include surrounding context.

python

role_content[role] = []
                role_content[role].append(content)
        
        # Create summary for each role
        summary_parts = []
        for role in ['system', 'user', 'assistant', 'tool']:
            if role in role_content:

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The compressor explicitly aggregates content from prior system, user, assistant, and tool messages into a new summary message, which can preserve and restate sensitive information users previously provided. That summarized content is then retained in the session and later logged via the stats/update flow, creating a natural-language data retention and disclosure path even though it is framed as benign context compression.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script performs external Google Sheets writes without any explicit warning or consent flow at runtime, despite operating on potentially sensitive session history. Users invoking a local compression utility may not realize it also makes authenticated outbound requests, which undermines informed consent and privacy expectations.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script reads Google OAuth credential material from a local config path despite the advertised function being session compression. Accessing unrelated credentials broadens the trust boundary and enables authenticated external actions that users would not reasonably expect from this skill.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.