Security audit

Stuck

Security checks for vulnerabilities and agentic risk

Overview

This skill has a useful help-document purpose, but it broadly discovers local AI chat histories across tools and can expose unrelated private conversation data.

Install only if you are comfortable letting the skill inspect local AI coding chat histories. Before use, review the listed conversations carefully, avoid selecting unrelated sessions, and expect paths, prompts, errors, and snippets from prior chats to be printed or placed into HELP_REQUEST.md. Prefer a version that limits discovery to the current project and requires explicit consent for cross-project history access.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: ` interface, causing message and error content from a selected unrelated session to be parsed and returned. ### Impact Assessment The affected scope includes conversation histories readable by the current operating-system account under: - `~/.codex/sessions` - `~/.codex/history.jsonl` - `~/.openclaw/agents/*/sessions` - `~/.gemini/tmp/*/chats` Information exposed during discovery can include: - Absolute conversation-file paths - Conversation timestamps and sizes - AI tool identities - OpenClaw agent id ...[truncated 819 chars]:139
Finding: Cross-Project AI Conversation History Enumeration
Content: View full analysis
list: codex_sessions = os.path.expanduser("~/.codex/sessions") conversations = [] if not os.path.isdir(codex_sessions): return conversations for f in glob.glob(os.path.join(codex_sessions, "**", "rollout-*.jsonl"), recursive=True): info = _file_info(f) info["tool"] = "codex_cli" info["project"] = os.path.dirname(f).replace(codex_sessions, "").strip("/") conversations.append(info) history = os.path.expanduser("~/.codex/history.jsonl") if os.path.isfile(history): info = _file_info(history) info["tool"] = "codex_cli" info["project"] = "global_history" conversations.append(info) ``` `scripts/parse_conversations.py:195-211`: ```python def find_openclaw(project_dir: str = None) -> list: openclaw_dir = os.path.expanduser("~/.openclaw/agents") conversations = [] if not os.path.isdir(openclaw_dir): return conversations for agent_dir in os.listdir(openclaw_dir): sessions_dir = os.path.join(openclaw_dir, agent_dir, "sessions") if not os.path.isdir(sessions_dir): continue for f in glob.glob(os.path.join(sessions_dir, "*.jsonl")): info = _file_info(f) info["tool"] = "openclaw" info["project"] = agent_dir conversations.append(info) conversations.sort(key=lambda x: x["modified"], reverse=True) return conversations[:20] ``` `scripts/parse_conversations.py:265-280`: ```python def find_gemini(project_dir: str = None) -> list: gemini_tmp = os.path.expanduser("~/.gemini/ ...[truncated 5260 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (9)

Tp4

High

Category: MCP Tool Poisoning
Confidence: 98% confidence
Finding: The documented behavior says the skill generates a help-request document from specified sessions, but the referenced implementation behavior is broader: it can enumerate conversation stores under multiple home-directory locations and produce listings/summaries beyond the declared purpose. This mismatch is dangerous because users and reviewers may authorize a seemingly narrow skill that actually performs wider local data discovery and extraction.
Content: No source excerpt is available for this finding.

Undeclared Tool Scope

Medium

Category: MCP Least Privilege
Confidence: 90% confidence
Finding: The skill instructs reading conversation data and project files, but it declares no explicit tool scope or permissions. In practice this creates hidden file-access capability, which weakens consent and review boundaries and can expose sensitive local data if the skill is invoked unexpectedly or implemented more broadly than users realize.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: Broad trigger phrases like 'stuck' or 'help request' can cause accidental activation during normal conversation. Because this skill can lead to conversation enumeration and extraction, unintended invocation increases the chance of unnecessary access to sensitive chat histories or project context.
Content: No source excerpt is available for this finding.

Vague Triggers

Medium

Category: Not specified by scanner
Confidence: 88% confidence
Finding: The activation condition is underspecified and relies on example phrases rather than strict trigger rules, making it easier for the skill to run outside the user's intended context. Given the skill's access to conversation artifacts and project data, ambiguous activation raises the likelihood of over-collection and privacy-impacting behavior.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The Codex discovery routine ignores the supplied project scope and scans global session and history locations under ~/.codex, including global_history. In the context of a help-request generator, this can pull unrelated conversations from other repositories or tasks, causing unintended cross-project data exposure when later listed or summarized.
Content: No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The OpenClaw and Gemini discovery functions enumerate all local sessions from user-wide directories rather than only sessions tied to the requested scope. Because this skill is designed to extract conversation content into a help document, broad enumeration increases the chance of collecting and exposing sensitive prompts, code, paths, or credentials from unrelated work.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: In list-all mode, the script emits machine-readable JSON for the most recent conversations to stderr without explicit user disclosure. Stderr is often captured by wrappers, logs, or parent processes, so metadata such as file paths, tool names, timestamps, and project identifiers can be exfiltrated unexpectedly even when the visible terminal output seems limited.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 91% confidence
Finding: The script summarizes and emits user/assistant message content from local AI conversation histories, which can contain sensitive prompts, code, file paths, or tool outputs. Although the module docstring explains what files are parsed, there is no explicit warning in the command help, comments near output, or other user-facing disclosure that running summary/list commands may reveal private conversation data.
Content: No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The inline comments specify behavior in Chinese, indicating the skill is oriented toward a specific language context without any visible user choice or justification in the file. This can violate language/locale policy expectations when a skill imposes a language preference without opt-in.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.