c3po-session-cleaner

• Outcome: Review
• Latest audit: May 29, 2026 at 9:31 PM UTC
• Version:
  1.0.5

Overview

This skill is a disclosed session-log cleaner, but it can delete local OpenClaw session files with a broad trigger and no confirmation.

Install only if you intentionally want an agent shortcut that deletes old OpenClaw session .jsonl files from the hardcoded main-agent directory. Before use, consider changing the trigger to something specific and adding a dry-run or confirmation step so routine wording cannot erase session history by accident.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (1)

Vague Triggers

Medium

• Confidence: 95% confidence
• Finding: The trigger phrase "clean sessions" is broad and resembles normal conversational language, making accidental invocation plausible during routine discussion or maintenance requests. Because the skill performs file deletion in a fixed session directory, unintended triggering could cause loss of session history or operational data without explicit user intent.

VirusTotal

64/64 vendors flagged this skill as clean.