Session Archive Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 3:26 AM UTC
• Version: 1.0.0

Overview

The skill is meant to manage OpenClaw session files, but it can rewrite or delete history and install recurring cron execution through under-scoped root paths.

Review and modify this skill before installing. Use one-shot manual runs first, avoid setup_cron.sh unless you have fixed the path, schedule, confirmation, and uninstall behavior, remove the pip install line, and treat generated summaries and archives as sensitive session data that may contain commands, private paths, and credentials.

A.I.G

Vulnerability Patterns

• System Persistence: Installs backdoors, hooks, services, or scheduled tasks that survive the run
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (6)

T08 · Insecure Dependencies

Error

• Location: SKILL.md:180

Finding

Unsafe installation instructions for standard-library package names

Content

View full analysis

Remediation

View remediation

T06 · System Persistence

Error

• Location: scripts/setup_cron.sh:5

Finding

Persistent cron task executes a mutable external workspace script

Content

View full analysis

> $CRON_LOG 2>&1" # Check whether the script exists if [ ! -f "$SCRIPT_PATH" ]; then echo "Error: script not found: $SCRIPT_PATH" exit 1 fi # Ensure that the script is executable chmod +x "$SCRIPT_PATH" # Create the log file touch "$CRON_LOG" # Check whether the same task already exists if crontab -l 2>/dev/null | grep -q "$SCRIPT_PATH"; then # Remove the previous task and install the replacement (crontab -l 2>/dev/null | grep -v "$SCRIPT_PATH"; echo "$CRON_JOB") | crontab - else # Add a new task (crontab -l 2>/dev/null; echo "$CRON_JOB") | crontab - fi ``` ### Technical Analysis The persistence mechanism is related to the documented automatic-archive feature, but it does not schedule the reviewed `scripts/archive_sessions.sh` file from the Skill package. Instead, it executes `/root/.openclaw/workspace/archive_sessions.sh`, an external mutable file. Only the existence of the target is checked. The setup script does not verify: - Whether the target is a symbolic link. - Whether its owner matches the cron owner. - Whether another account can modify it. - Whether its content matches the reviewed script. - Whether the parent directory is securely permissioned. The setup operation also makes the external file executable and installs it into the invoking user's crontab. Once installed, replacing the external file changes the effective persistent payload without requiring any modification to the audited Skill. ### Attack Path 1. An attacker gains write access to `/root/.openclaw/workspace/archive_sessions.sh` or causes it to resolve to attacker-controlled c ...[truncated 850 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/setup_cron.sh:7

Finding

Installed cron frequency contradicts the documented daily schedule

Content

View full analysis

> $CRON_LOG 2>&1" echo "=== Complete ===" echo "The scheduled task has been configured to run once per hour" echo "Use 'crontab -l' to view the current task" echo "Use 'tail -f $CRON_LOG' to view the log" ``` The Skill documentation states that setup creates a task that runs daily at 02:00, while the expression `0 * * * *` runs at the start of every hour. ### Technical Analysis The actual schedule invokes the archive operation 24 times per day rather than once per day. This is security-relevant because the scheduled workload moves, compresses, trims, and eventually deletes session data. Users approving the setup based on the documentation are not accurately informed about the frequency of persistent execution. Although the setup script prints the hourly frequency after making the change, that notice occurs after crontab modification and conflicts with the declared setup behavior. ### Attack Path 1. A user reviews the Skill documentation and expects a daily task at 02:00. 2. The user executes `scripts/setup_cron.sh`. 3. The script installs `0 * * * *`, which runs hourly. 4. Archive and retention operations execute 24 times more frequently than expected. 5. Session movement, log growth, and destructive retention behavior occur on an unexpectedly aggressive schedule. ### Impact Assessment This issue does not directly grant an attacker additional privileges. It increases operational and data-integrity risk by repeatedly invoking scripts that alter session files. Potential effects include excessive archive processing, unexpected movement of sessions, additional race opportunities, rapid log growth, and earlier-than-anticipated triggering of retention behavior. ]]>

Remediation

View remediation

> \"$CRON_LOG\" 2>&1" ``` Alternatively, update the documentation to disclose the hourly schedule, explain its data-retention implications, and request confirmation before installation. The setup script should display the proposed cron entry and frequency before changing the user's crontab. ]]>

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cleanup_old_sessions.sh:20

Finding

Whitespace-unsafe filename handling can delete unintended files

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:163

Finding

Troubleshooting guidance removes active-session lock protection indiscriminately

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/session_summarizer.py:178

Finding

Full session commands and private paths are retained in plaintext summaries

Content

View full analysis

50 else args["command"] action += f" ({cmd_preview}...)" self.summary["commands_run"].append(args["command"]) self.summary["key_actions"].append(action) ``` ```python summary_file = output_dir / f"{base_name}_summary_{timestamp}.json" with open(summary_file, 'w', encoding='utf-8') as f: json.dump(self.summary, f, ensure_ascii=False, indent=2) ``` ### Technical Analysis The summarizer stores complete `exec` command strings in `commands_run` and stores referenced filesystem paths in `files_accessed`. Commands recorded in agent sessions may contain bearer tokens, passwords, API keys, credential-bearing URLs, private hostnames, or other secrets. The summary is written as unencrypted JSON using the process's default file-creation permissions. No secret detection, redaction, field minimization, explicit `0600` mode, or encryption is applied. As a result, sensitive values can remain accessible in summary files even after the original session is compressed or deleted. ### Attack Path 1. A session executes or records a command containing a secret, such as a token passed in an argument or URL. 2. `session_summarizer.py` analyzes the sess ...[truncated 798 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (33)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence

Finding

The skill description does not clearly disclose that it may modify crontab, set executable permissions, or perform other system-level changes. Hidden persistence or scheduler modification is especially sensitive in an agent skill because it extends execution beyond the current user request and can repeatedly trigger future file modifications without fresh consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

The skill description does not clearly disclose that it may modify crontab, set executable permissions, or perform other system-level changes. Hidden persistence or scheduler modification is especially sensitive in an agent skill because it extends execution beyond the current user request and can repeatedly trigger future file modifications without fresh consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 98% confidence

Finding

The skill description does not clearly disclose that it may modify crontab, set executable permissions, or perform other system-level changes. Hidden persistence or scheduler modification is especially sensitive in an agent skill because it extends execution beyond the current user request and can repeatedly trigger future file modifications without fresh consent.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill description does not clearly disclose that it may modify crontab, set executable permissions, or perform other system-level changes. Hidden persistence or scheduler modification is especially sensitive in an agent skill because it extends execution beyond the current user request and can repeatedly trigger future file modifications without fresh consent.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 92% confidence

Finding

The documented rm -f ~/.openclaw/agents/main/sessions/*.lock command performs forceful wildcard deletion without validation of the lock state, ownership, or whether another process is actively using the file. In the context of live session management, indiscriminate lock removal can corrupt concurrent operations, break synchronization, or normalize unsafe operator behavior around destructive shell commands.

Content

Scanner excerpt · SKILL.md (reported line 166)May include surrounding context.

如果看到 .lock 文件，先删除：

bash

rm -f ~/.openclaw/agents/main/sessions/*.lock

权限问题

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Using find output piped through xargs rm -f is unsafe because filenames containing spaces, newlines, tabs, or shell-metacharacter-like separators can be split into unintended arguments. In a session/archive management skill that deletes files under privileged paths (/root/.openclaw), this can cause incorrect file deletions or make cleanup behavior attacker-influenceable if a maliciously named file is present.

Content

Scanner excerpt · scripts/cleanup_old_sessions.sh (reported line 27)May include surrounding context.

sh

else
        COUNT=$(echo "$OLD_MEMORY" | wc -l)
        echo "找到 $COUNT 个旧memory文件"
        echo "$OLD_MEMORY" | xargs rm -f
        TOTAL_DELETED=$((TOTAL_DELETED + COUNT))
        echo "✅ 已删除 $COUNT 个memory文件"
    fi

Chaining Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

This deletion path has the same unsafe filename-handling flaw: find output is captured and then passed via xargs rm -f, which breaks on unusual filenames and can delete unintended files. Because this skill is explicitly designed to clean up logs and free space automatically, the operational context increases risk: automated execution under root magnifies the impact of malformed or attacker-planted filenames in the logs tree.

Content

Scanner excerpt · scripts/cleanup_old_sessions.sh (reported line 46)May include surrounding context.

sh

else
        COUNT=$(echo "$OLD_LOGS" | wc -l)
        echo "找到 $COUNT 个旧日志文件"
        echo "$OLD_LOGS" | xargs rm -f
        TOTAL_DELETED=$((TOTAL_DELETED + COUNT))
        echo "✅ 已删除 $COUNT 个日志文件"
    fi

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence

Finding

The skill advertises and documents shell execution and file modification behavior, including rewriting session files, deleting lock files, changing permissions, and setting up cron jobs, but it declares no explicit tool scope or permission boundaries. In an agent setting, missing scope declarations makes these destructive capabilities harder to constrain or review, increasing the chance of unintended file-system changes or command execution beyond user expectations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The manifest description and document content are presented entirely in Chinese, which effectively imposes a specific language on users without opt-in or explanation. Under the policy, language constraints should either offer user choice or be clearly documented as necessary for a region-specific use case.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The skill encourages immediate use for session archival and cleanup but does not present a clear warning that data may be rewritten, archived, deleted, or scheduled for automated future processing. In a data-management skill, lack of up-front warning increases the chance of accidental destructive actions on valuable session history.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script's natural-language comments and console messages are entirely in Chinese, which imposes a specific language on users and operators. The file does not offer any language choice or document a justified locale-specific scope, so this is a language-policy issue under the stated rule.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script permanently deletes archived session files older than 30 days with rm -f, but the skill description only advertises archiving, summarizing, and cleanup of session space without clearly disclosing retention-based destruction of archived data. In a session-management skill, this can cause silent loss of audit/history data that a user may reasonably expect to remain recoverable after archiving.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script permanently deletes archived .jsonl.gz files older than 30 days and summary JSON files older than 60 days, which exceeds simple archiving/summarization and creates an undisclosed data-destruction behavior. In a session-management skill, these files may contain audit trails, user history, or recovery material, so silent retention-based deletion can cause irreversible loss and weaken forensic or compliance needs.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The summarizer is explicitly designed to collect and retain sensitive conversation-derived data such as participants, file references, commands run, tool calls, and summary text, then save that information in a new artifact. In the context of session archival, this broadens exposure by making sensitive operational details easier to search, copy, or exfiltrate than the raw session stream, especially if summaries are stored in shared or less protected locations.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The script writes a structured summary of session contents to disk, including metadata and extracted details from conversations, without any consent prompt, warning, retention controls, or redaction. Because session files may contain sensitive prompts, file paths, participant identifiers, commands, and tool activity, persisting a derivative artifact increases the privacy and data-retention risk beyond the original session file.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium

• Category: Not specified by scanner
• Confidence: 85% confidence

Finding

The module docstring describes taking old content, summarizing it, and archiving that extracted material. In implementation, trim_session() writes a summary file but archives a compressed copy of the full original session (shutil.copy2(self.session_file, backup_file)), then overwrites the original file with only recent messages. This is a meaningful contradiction in documented behavior, not just an omitted detail.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code file contains natural-language instructions and status text that force a specific language/locale for users. Under the policy, locale constraints should either be optional for the user or clearly justified as region-specific, neither of which is present here.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The summarization logic derives and persists metadata from historical session content, including topics, file paths, timestamps, and activity indicators, into a separate summary artifact. In a session-management skill, this is materially risky because sessions often contain sensitive prompts, operational details, filesystem locations, and workflow history; creating a second, easier-to-read artifact broadens exposure and can bypass expectations that trimming reduces retained sensitive data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The tool creates a compressed backup containing the entire original session before trimming, preserving all prior conversation data in full. In this skill context, that undermines the expected privacy/storage benefit of trimming and increases the number of copies of potentially sensitive session data, raising risk from local compromise, misconfigured permissions, accidental sharing, or over-retention.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

This script installs a persistent hourly cron job under a hard-coded root-owned workspace path, which extends the skill's behavior beyond one-time session archiving into ongoing system-level task management. In the context of an agent skill, persistence increases risk because any later modification to the target script or its environment will be executed automatically and repeatedly, potentially without further user awareness.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

Listing and managing crontab entries is part of establishing persistence, and here it supports installing a recurring task that will continue running independently of the initiating session. Within a session-archiving skill, this makes the behavior more dangerous because it creates durable execution on the host rather than performing a bounded maintenance action.

Content

Scanner excerpt · scripts/setup_cron.sh (reported line 30)May include surrounding context.

sh

# 检查当前的 cron 任务
echo "当前的 cron 任务:"
crontab -l 2>/dev/null || echo "(暂无定时任务)"
echo ""

# 检查是否已经存在相同的任务

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 94% confidence

Finding

This check determines whether the target script is already present in the user's crontab, enabling silent update of an existing persistent task. The danger is not the grep itself, but that it facilitates maintaining recurring execution, which can repeatedly run a modified or compromised archive script over time.

Content

Scanner excerpt · scripts/setup_cron.sh (reported line 34)May include surrounding context.

sh

echo ""

# 检查是否已经存在相同的任务
if crontab -l 2>/dev/null | grep -q "$SCRIPT_PATH"; then
    echo "定时任务已存在，正在更新..."
    # 删除旧任务
    (crontab -l 2>/dev/null | grep -v "$SCRIPT_PATH"; echo "$CRON_JOB") | crontab -

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This code rewrites the current crontab to remove matching entries and install a new scheduled command, directly establishing durable execution. Because the script path and log path are hard-coded under /root, successful use in a privileged context could create a high-impact persistence mechanism that repeatedly executes whatever resides at that path.

Content

Scanner excerpt · scripts/setup_cron.sh (reported line 37)May include surrounding context.

sh

if crontab -l 2>/dev/null | grep -q "$SCRIPT_PATH"; then
    echo "定时任务已存在，正在更新..."
    # 删除旧任务
    (crontab -l 2>/dev/null | grep -v "$SCRIPT_PATH"; echo "$CRON_JOB") | crontab -
else
    echo "添加新的定时任务..."
    # 添加新任务

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 95% confidence

Finding

This branch appends a new cron job, creating recurring execution every hour with output redirected to a file in the same workspace. In an agent-skill setting, that persistence is risky because any subsequent tampering with the scheduled script or writable workspace can convert a maintenance helper into an automatic execution foothold.

Content

Scanner excerpt · scripts/setup_cron.sh (reported line 41)May include surrounding context.

sh

else
    echo "添加新的定时任务..."
    # 添加新任务
    (crontab -l 2>/dev/null; echo "$CRON_JOB") | crontab -
fi

echo ""

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 85% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · scripts/setup_cron.sh (reported line 47)May include surrounding context.

sh

echo ""
echo "=== 完成 ==="
echo "定时任务已设置为每小时运行一次"
echo "可以使用 'crontab -l' 查看当前任务"
echo "可以使用 'tail -f $CRON_LOG' 查看日志"

Static analysis

No suspicious patterns detected.