Security audit

Session Janitor

Security checks for vulnerabilities and agentic risk

Overview

This cleanup skill mostly matches its purpose, but it has background access to sensitive session data and several under-disclosed ways to mutate, persist, or publish transcript-derived information.

Review config.json before installing or running setup. Back up session directories, protect the generated config because it may contain gateway tokens, and consider disabling llmExtraction, memCli, extractOnTrim, watchdog, Slack alerts, autoRestart, and any sceneFilesPath setting unless you explicitly want transcript-derived data processed, stored, or pushed elsewhere.

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (27)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: from datetime import date msg = f"janitor: scene file update {date.today().isoformat()}" subprocess.run(["git", "-C", repo_dir, "commit", "-m", msg], timeout=10, check=True) subprocess.run(["git", "-C", repo_dir, "push"], timeout=30, check=True) print(f"Committed and pushed {len(changed)} scene file(s)") except subprocess.CalledProcessError as e: print(f"git commit/push failed (non-fatal): {e}", file=sys.stderr)
Confidence: 97% confidence
Finding: Automatically pushing extracted conversation-derived memories to a configured git remote can exfiltrate sensitive transcript content outside the local system. In a janitor-style skill, silent network publication materially increases risk because users would reasonably expect cleanup and extraction, not outbound synchronization of durable memory artifacts.

subprocess module call

Medium

Category: Dangerous Code Execution
Content: if mem_enabled: for mem in memories: try: result = subprocess.run( [mem_path, "quick-store", mem["scene"], mem["type"], str(mem["salience"]), mem["content"]], capture_output=True, text=True, timeout=10 )
Confidence: 82% confidence
Finding: The executable path mem_path comes from argv and is invoked directly, which allows a caller or compromised configuration to make the script run an arbitrary local program. In an agent skill context, treating a configurable binary path as trusted expands the execution boundary and can turn a memory-storage feature into arbitrary code execution under the skill's privileges.

Description-Behavior Mismatch

Medium

Confidence: 89% confidence
Finding: The example configuration exposes operational capabilities well beyond transcript trimming and memory extraction by including watchdog-driven Slack alerting and restart-script hooks. Even though some options are disabled by default, documenting and normalizing these controls inside the skill broadens its effective scope and encourages deployment of side-effecting actions that can affect external systems and service availability.

Context-Inappropriate Capability

Medium

Confidence: 84% confidence
Finding: Slack notification settings introduce an external communication channel unrelated to the stated janitorial purpose, creating a path for data leakage or unauthorized operational signaling. In the context of a session-management skill, this is more dangerous because session health alerts can reveal usage patterns, identifiers, or internal state to third-party systems without a clear business need in the declared scope.

Context-Inappropriate Capability

High

Confidence: 93% confidence
Finding: Configurable restart-script execution is a powerful operational capability that exceeds janitorial transcript maintenance and can directly impact gateway availability or become a command-execution foothold if misused. This is especially dangerous here because the example normalizes script paths for automated restarts, making destructive or privilege-sensitive behavior appear as a routine extension of a housekeeping skill.

Description-Behavior Mismatch

High

Confidence: 98% confidence
Finding: The skill claims janitorial transcript hygiene but also performs durable scene-file writes plus git commit and push, which materially exceed the declared capability boundary. Hidden or under-disclosed capability expansion is dangerous because operators may grant the skill access appropriate for cleanup tasks without realizing it can publish conversation-derived data to a repository remote.

Context-Inappropriate Capability

High

Confidence: 99% confidence
Finding: Automatic git push is an unjustified capability for a janitor/extraction helper because it sends derived transcript content to external infrastructure without a clear operational need tied to transcript trimming. In this skill context, the mismatch makes the behavior more dangerous, since users and defenders are less likely to anticipate outbound publication from a housekeeping component.

Intent-Code Divergence

Medium

Confidence: 93% confidence
Finding: The docstring advertises extraction guardrails but omits that the script also writes durable scene files and performs git commit/push. This under-disclosure is security-relevant because reviewers and operators may underestimate the data persistence and exfiltration capabilities of the script, leading to inappropriate deployment or permissioning.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The setup script installs persistent cron and watcher services that continuously execute the janitor after setup completes. Even if intended for maintenance, persistence mechanisms expand the skill's system footprint and create ongoing execution without limiting this to a one-shot configuration task.

Context-Inappropriate Capability

Medium

Confidence: 89% confidence
Finding: The script reads gateway auth tokens from OpenClaw configuration and writes them into the generated config.json even though this setup flow mainly needs session paths and scheduling metadata. Collecting and persisting secrets beyond immediate necessity increases exposure if the config file, logs, or downstream janitor components are accessed by other local users or compromised processes.

Description-Behavior Mismatch

Medium

Confidence: 92% confidence
Finding: The script performs outbound Slack notifications and can invoke restart scripts, which are operational control actions beyond the narrowly described janitorial role of transcript trimming, memory extraction, and session pruning. In a skill ecosystem, this scope expansion is dangerous because it grants messaging and service-control capabilities that may not be expected, reviewed, or consented to by deployers.

Context-Inappropriate Capability

High

Confidence: 95% confidence
Finding: This file includes both outbound messaging and process-control capabilities, allowing it to communicate externally and execute restart scripts based on parsed configuration. Even if intended for reliability, these are high-risk privileges for a janitor-style skill because they create a path for unauthorized notifications, disruptive restarts, or abuse if configuration or surrounding components are compromised.

Context-Inappropriate Capability

Medium

Confidence: 85% confidence
Finding: The watcher consults an unrelated file at $HOME/repos/swabby-brain/memory/active-workers.json to decide whether to skip reload behavior. That creates an unscoped trust dependency outside the janitor skill's own configuration and session store, so a stale, missing, or attacker-modified file can influence transcript-management and reload decisions for unrelated sessions. In a session hygiene skill, cross-component state coupling is more dangerous because it affects when maintenance actions are suppressed or applied.

Missing User Warnings

Medium

Confidence: 91% confidence
Finding: The README instructs users to run setup that auto-discovers gateways, generates configuration, and installs a cron job, but it does not prominently warn that the tool will archive and delete transcript/session data. For a maintenance tool operating on conversation histories, lack of informed-consent and data-retention warning can cause unexpected data loss or forensic blind spots once deployed automatically.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README advertises LLM memory extraction via the gateway chat completions API without clearly stating that trimmed transcript content may be sent to an LLM endpoint for processing. Because transcripts can contain sensitive user prompts, tool outputs, secrets, or regulated data, omitting an explicit privacy notice can lead to unintentional disclosure to external or separately governed model services.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly trims, archives, prunes, and cleans transcript/session artifacts, but the user-facing description does not prominently warn that these actions can permanently delete or alter operational history. In a session-management context, losing transcripts, checkpoints, or session metadata can hinder incident response, compliance, debugging, and recovery.

Missing User Warnings

Low

Confidence: 90% confidence
Finding: The setup instructions install cron jobs and watcher services that run automatically in the background, but this persistence is not presented as a prominent warning at the point of installation. Hidden or insufficiently disclosed background execution increases operational risk because the skill may continue modifying data and calling APIs long after the initial install.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Archived transcript content is sent to an external LLM API, which can include sensitive or private user information from prior conversation history. Without explicit disclosure, consent, or content filtering, this creates an avoidable privacy and data-governance risk, especially for a maintenance-oriented skill processing archived sessions.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: Scene-file updates are automatically committed and pushed without an explicit warning, which can publish extracted summaries of private conversations to remote repositories. The lack of notice and approval makes this especially risky because users may not realize that semantic summaries of their transcript are being made durable and synchronized elsewhere.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script sends archived transcript content to an HTTP LLM endpoint on 127.0.0.1 using a configured token, with no explicit consent, disclosure, or content-sensitivity checks. Even though the destination is loopback, this can still expose sensitive session history to another service or plugin on the host, and local plaintext transport plus broad automation increases accidental data leakage risk in a session-hygiene tool.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script modifies user persistence mechanisms by installing cron jobs and launchd/systemd watcher services without asking for confirmation. Silent system changes reduce user awareness and can cause long-lived background execution that the operator did not knowingly approve.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: tempfile.mktemp() is insecure because it returns a pathname without creating the file atomically, leaving a race window where another local process can pre-create or replace that path. In a shared or adversarial local environment, this can lead to clobbering unintended files, symlink attacks, or test-state manipulation.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: This repeats the same mktemp pattern, creating a predictable temporary pathname before opening it and exposing a time-of-check/time-of-use race. A local attacker could exploit that gap to redirect writes via symlink or interfere with the trim state used by the tests.

Missing User Warnings

Medium

Confidence: 88% confidence
Finding: The Slack alert sends session metadata, including gateway name, session identifier, transcript size, and staleness timing, to an external channel without any visible notice, minimization, or consent controls in the script. While it does not send full transcript contents, this still leaks operational and potentially linkable session information to third-party messaging infrastructure.

Missing User Warnings

High

Confidence: 92% confidence
Finding: The script launches extract-llm.py against the archived pre-trim transcript and passes a chat completions endpoint plus bearer token, causing historical transcript content to be sent for LLM processing asynchronously. Even if the target is currently localhost, this is still sensitive-content transmission to another service boundary without any visible consent gate, minimization, or policy enforcement; in a transcript janitor skill, archived conversation data can contain secrets, credentials, or personal data, making this materially risky.

Static analysis

No suspicious patterns detected.