Session Storage Management

• Outcome: Review
• Latest audit: Sep 16, 2026 · 6:48 AM UTC
• Version: 1.0.1

Overview

The skill is for session cleanup, but it broadly reads stored conversation content and can delete session files, so users should review its scope before installing.

Install only if you are comfortable with an agent scanning your OpenClaw session history and potentially deleting selected session files after confirmation. Prefer using it for targeted cleanup, review deletion lists carefully, and avoid asking for detailed descriptions if your session history may contain secrets or sensitive personal information.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:75

Finding

Unnecessary Access to Sensitive Session Conversation Content

Content

View full analysis

/dev/null | head -5) if echo "$content" | grep -qiE "cron.*[a-f0-9-]{36}"; then type="cron" elif echo "$content" | grep -qiE "heartbeat|HEARTBEAT"; then type="heartbeat" elif echo "$content" | grep -qiE "new session|Session Startup"; then type="chat" else type="other" fi ``` ### Technical Analysis The skill instructs the agent to open session files and extract message text from their first ten records. Session records may contain private conversations, credentials, authentication tokens, personal information, or other sensitive material. Reading message bodies from every session is broader than necessary for a storage-cleanup operation. Classification should preferentially rely on filenames, timestamps, file sizes, trusted session metadata, and other non-content attributes. Although the reviewed file does not instruct the agent to transmit this information externally, processing message content exposes it to the executing agent and creates a risk that sensitive text could enter its working context or appear in generated session descriptions. The access occurs with the existing filesystem privileges of the agent. The skill does not independently elevate operating-system privileges, but it may cause the agent to access historical conversations beyond what is necessary for the requested cleanup task. ### Attack Path 1. A user or automated process invokes the skill to analyze session storage. 2. The skill enumerates active, deleted, and reset session files in the OpenClaw sessions directory. 3. For each candidate file, the provided command reads the first ten JSONL records. 4. `jq` extracts text elements from stored messages. 5. The ext ...[truncated 1022 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.