ChatGPT Exporter

• Outcome: Pass
• Latest audit: Sep 17, 2026 · 12:19 PM UTC
• Version: 1.9.2

Overview

This skill exports ChatGPT conversation data locally with clear consent, local storage warnings, destination checks, and no evidence of hidden credential theft or third-party exfiltration.

Install only if you are comfortable letting the skill read your ChatGPT history through your logged-in browser session and write a plaintext local export. Prefer index-only mode unless you need message bodies, keep exports out of synced or shared folders, enable redaction for full exports, and purge the files when finished.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (48)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The document makes extensive security and behavior claims about relay writes, symlink checks, purge validation, and export formats, but the static analysis indicates the available code chunk does not implement much of that behavior. A security-sensitive skill that overstates safeguards can mislead users into exporting highly sensitive chat history under false assumptions about destination controls, purge support, or output handling.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 4)May include surrounding context.

md

---
name: chatgpt-exporter-ultimate
version: 1.9.2
description: "Export your ChatGPT conversations to local files — titles, timestamps and, if you ask for it, full message text. Built for the TinkerClaw fork — github.com/globalcaos/tinkerclaw. Invoke it BY NAME — \"chatgpt-exporter-ultimate: export my conversations\" — so ordinary talk about ChatGPT cannot trigger it. Rides the ChatGPT session your browser already holds — browser relay or a bookmarklet you paste yourself. It reads NO access token, no cookie jar and no credential file. The relay enumerates your conversation list and writes JSON and Markdown copies to a private directory; it defaults to index-only (titles and timestamps, no message text) and refuses to run without an explicit confirmation of destination and scope. The bookmarklet can also find conversations inside Projects, by running searches against your history, and downloads one JSON file after three dialogs. Relay destinations are resolved through symlinks before anything is written, so a relay export cannot land in a synced folder, a git repo or outside your home, and a symlink or hard link left inside a reused export directory is refused instead of written through. A validated --purge deletes an export again. Off switch documented in the skill."
metadata:
  openclaw:
    permissions:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/export.sh (reported line 108)May include surrounding context.

sh

---
name: chatgpt-exporter-ultimate
version: 1.9.2
description: "Export your ChatGPT conversations to local files — titles, timestamps and, if you ask for it, full message text. Built for the TinkerClaw fork — github.com/globalcaos/tinkerclaw. Invoke it BY NAME — \"chatgpt-exporter-ultimate: export my conversations\" — so ordinary talk about ChatGPT cannot trigger it. Rides the ChatGPT session your browser already holds — browser relay or a bookmarklet you paste yourself. It reads NO access token, no cookie jar and no credential file. The relay enumerates your conversation list and writes JSON and Markdown copies to a private directory; it defaults to index-only (titles and timestamps, no message text) and refuses to run without an explicit confirmation of destination and scope. The bookmarklet can also find conversations inside Projects, by running searches against your history, and downloads one JSON file after three dialogs. Relay destinations are resolved through symlinks before anything is written, so a relay export cannot land in a synced folder, a git repo or outside your home, and a symlink or hard link left inside a reused export directory is refused instead of written through. A validated --purge deletes an export again. Off switch documented in the skill."
metadata:
  openclaw:
    permissions:

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 13)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 47)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 86)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 87)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 146)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 170)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 193)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 207)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 223)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 231)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 243)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 251)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 268)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 319)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 320)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 321)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 335)May include surrounding context.

md

ze a destination or a purge target; and coreutils (date, du, head, rm). scripts/export.sh makes NO network calls at all — it neither fetches nor authenticates.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 63)May include surrounding context.

md

(19 cases, incl. symlink bypasses and the removed overrides) and scripts/relay-selftest.ts

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 338)May include surrounding context.

md

(19 cases, incl. symlink bypasses and the removed overrides) and scripts/relay-selftest.ts

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 169)May include surrounding context.

md

| `scripts/export-conversations.ts` (relay) | `~/.local/share/chatgpt-export/<date>` | `.chatgpt-export-manifest.json`, `index.json`; unless index-only also `su

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 333)May include surrounding context.

md

| `scripts/export-conversations.ts` (relay) | `~/.local/share/chatgpt-export/<date>` | `.chatgpt-export-manifest.json`, `index.json`; unless index-only also `su

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 171)May include surrounding context.

md

| `scripts/bookmarklet.js` (browser) | your browser's Downloads folder | one `chatgpt-export-<date>.json` |

Static analysis

No suspicious patterns detected.