chat-history-importer

• Outcome: Pass
• Latest audit: Nov 4, 2026 · 8:11 PM UTC
• Version: 1.1.4

Overview

This skill imports selected chat exports into persistent agent memory, with clear disclosure and controls for limiting the import.

Set OPENCLAW_WORKSPACE explicitly, use a dedicated export folder and date filter, redact secrets, and back up existing memory. Dry-run output previews conversations rather than every generated entry. Review the source content and resulting memory before relying on it: imported text can affect future agent recall. The optional companion skill is outside this review.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Rogue Agent: Self-Modification, Session Persistence
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Skill declares no tool scope ('permissions' or 'allowed-tools') but code capabilities were detected: env, file_read, file_write, shell.

Medium

• Category: MCP Least Privilege
• Confidence: 70% confidence

Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

name: chat-history-importer
description: "Import AI conversation exports (OpenAI ChatGPT and Anthropic Claude) into your agent's episodic memory. Parses export files, writes daily memory summaries, and deduplicates on re-runs. Trigger phrases: import chat history, ingest conversation export, import chatgpt export, import claude export, load AI conversation history."
metadata: {"clawdbot":{"emoji":"\ud83d\udce5","requires":{"bins":["python3"],"env":[]},"env":[],"os":["linux","darwin","win32"],"homepage":"https://clawhub.com/djc00p/chat-history-importer","envVars":[{"name":"OPENCLAW_WORKSPACE","required":false,"description":"Agent workspace path to write memory into. Defaults to ~/.openclaw/workspace. Set this explicitly so imports land where you expect."}],"version":"1.1.3"}}
---

subprocess module call

Medium

• Category: Dangerous Code Execution
• Confidence: 70% confidence

Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/batch.py (reported line 51)May include surrounding context.

python

print(f"  Warning: no parser for format '{fmt}', skipping {file_path.name}", file=sys.stderr)
        return

    proc = subprocess.run(
        ["python3", str(parser_script), str(file_path)],
        capture_output=True, text=True
    )

Tainted flow: 'mem_file' from os.environ.get (line 161, credential/environment) → open (file write)

Medium

• Category: Data Flow
• Confidence: 65% confidence

Finding

Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Content

Scanner excerpt · scripts/batch.py (reported line 174)May include surrounding context.

python

content = msg['content'][:200].replace("\n", " ")
                        summary.append(f"- {speaker}: {content}...")
                    entry += "\n".join(summary) + "\n"
                    with open(mem_file, 'a') as f:
                        f.write(entry)
                    print(f"    Wrote episodic entry")
                else: