TinkerClaw ChatGPT Exporter

• Outcome: Review
• Latest audit: Jul 10, 2026 · 4:18 AM UTC
• Version: 1.3.2

Overview

This skill appears to export ChatGPT history as advertised, but it handles full private conversation history and live ChatGPT session credentials with too little warning or control.

Review carefully before installing. Only run this if you intentionally want a plaintext local copy of your full ChatGPT history, including sensitive prompts, responses, timestamps, IDs, and project conversations. Prefer a private non-synced output directory, restrict file permissions, do not share raw exports, and avoid passing live access tokens on the command line.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (12)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 82% confidence
• Finding: The skill advertises capabilities consistent with network and shell access but declares no permissions, which undermines informed user consent and any permission-gating the platform may rely on. In a skill designed to export all conversations, undeclared network and shell capabilities are especially sensitive because they could be used to collect, transform, and exfiltrate highly private chat data.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 94% confidence
• Finding: The documented purpose materially understates the actual behavior: local file writes, markdown generation, token/relay requirements, and broad search-based enumeration of conversations/projects are all sensitive operations that affect user data exposure and scope. This mismatch prevents users from understanding what will happen to their data and creates a realistic risk of over-collection, unintended persistence, or misuse of credentials/access context.

Vague Triggers

Medium

• Confidence: 76% confidence
• Finding: The invocation guidance is so broad ('Install the skill. Run it. Get your full export.') that it omits operational boundaries, required context, and data-handling consequences for a highly sensitive export action. Ambiguous invocation increases the chance of accidental full-account export, execution in an unintended environment, or use without understanding prerequisite authentication and storage side effects.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill promotes exporting all conversations and metadata without warning that the data may include sensitive personal, financial, medical, proprietary, or credential-like content. Because the tool appears designed for comprehensive history extraction, the absence of a prominent warning materially increases the risk of users exporting and storing sensitive data insecurely or sharing it unintentionally.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The script is explicitly designed to export complete ChatGPT conversation history, including message contents, timestamps, and metadata, into a downloadable JSON file. Although the file is saved locally rather than exfiltrated to a remote server, this still creates a clear sensitive-data exposure risk because users may export private prompts, secrets, or regulated data without any meaningful warning, minimization, or consent checkpoint beyond generic comments.

Missing User Warnings

Medium

• Confidence: 91% confidence
• Finding: The skill exports complete ChatGPT conversations, including full message content, timestamps, IDs, and metadata, and writes them to local files by default without any explicit consent prompt, sensitivity warning, retention notice, or output-path confirmation. Because ChatGPT histories commonly contain credentials, personal data, proprietary information, or regulated content, silent bulk persistence to disk materially increases exposure through local compromise, backups, syncing services, or accidental sharing.

Missing User Warnings

Medium

• Confidence: 89% confidence
• Finding: The script exports complete ChatGPT conversation data and stores both raw JSON and Markdown locally in plaintext under a predictable directory without warning the user about the sensitivity of that content. This creates a meaningful confidentiality risk because exported chats may contain credentials, personal data, proprietary material, or regulated information that can later be exposed through local compromise, backups, syncing, or shared workspaces.

Missing User Warnings

Medium

• Confidence: 81% confidence
• Finding: The script sends a bearer access token to remote ChatGPT endpoints but provides no explicit warning that a live session credential is being used for authenticated network requests. While network transmission to the intended service is expected for functionality, the lack of notice increases the chance users will mishandle a powerful token or fail to understand its sensitivity and reuse risk.

Ssd 3

High

• Confidence: 97% confidence
• Finding: The script explicitly instructs the user to extract an access token from the browser session and use it to export all conversations. This facilitates credential harvesting and bulk access to highly sensitive account data; if copied in the wrong context, logged, shared, or reused elsewhere, the token can enable unauthorized access to the user's conversation history.

Credential Access

High

• Category: Privilege Escalation

Content

(async function () {
  console.log("🚀 ChatGPT Exporter v2.0 starting...");

  // Get access token
  console.log("🔑 Getting access token...");
  const sessionResp = await fetch("/api/auth/session", { credentials: "include" });
  const { accessToken } = await sessionResp.json();

• Confidence: 97% confidence
• Finding: access token

Credential Access

High

• Category: Privilege Escalation

Content

console.log("🚀 ChatGPT Exporter v2.0 starting...");

  // Get access token
  console.log("🔑 Getting access token...");
  const sessionResp = await fetch("/api/auth/session", { credentials: "include" });
  const { accessToken } = await sessionResp.json();

• Confidence: 97% confidence
• Finding: access token

Credential Access

High

• Category: Privilege Escalation

Content

if [ -z "$TOKEN" ]; then
  echo "Usage: ./export.sh <access_token> [output_dir]"
  echo ""
  echo "Get your access token by running this in browser console on chatgpt.com:"
  echo "  fetch('/api/auth/session').then(r=>r.json()).then(d=>console.log(d.accessToken))"
  exit 1
fi

• Confidence: 98% confidence
• Finding: access token

VirusTotal

60/60 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.