T09 · Insecure Skill Coding Practices
Error
- Location
scripts/janitor.sh:19- Finding
Arbitrary Command Execution Through Unquoted Configuration Evaluation
- Content
View full analysis
- Remediation
View remediation
Security audit
Session Janitor
Security checks for vulnerabilities and agentic risk
Overview
The skill mostly matches its cleanup purpose, but it installs persistent jobs and has under-disclosed data publication and command-execution risks that need manual review.
Review this before installing. Use it only on gateways where automatic transcript rewriting and deletion are acceptable, back up sessions first, keep config.json private and user-writable only, and disable LLM extraction, sceneFilesPath, watchdog auto-restart, and Slack alerts unless you explicitly need them. Be especially cautious if any Git-backed memory directory is configured, because private transcript-derived facts may be committed and pushed.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (4)
T09 · Insecure Skill Coding Practices
Error
- Location
scripts/watchdog.sh:22- Finding
Arbitrary Command Execution Through Watchdog Configuration Evaluation
- Content
View full analysis
/tmp/watchdog-command-execution)" } } ``` This command substitution is evaluated immediately when the watchdog loads its configuration. Exploitation does not require `autoRestart` to be enabled because injection occurs at the initial `eval`, before restart logic is evaluated. ### Attack Path 1. An attacker gains write access to `config.json`. 2. Shell syntax is placed in `slackChannel`, `slackTarget`, `restartScriptSlack`, or `restartScriptDiscord`. 3. The watchdog is invoked manually or by `janitor.sh`. 4. `read_alert_config` emits the attacker-controlled value as shell source code. 5. `eval` executes the injected command with the installing user's privileges. ### Impact Assessment Explo ...[truncated 231 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:135- Finding
Gateway Bearer Tokens Are Duplicated Into a Plaintext File Without Enforced Permissions
- Content
View full analysis
- Remediation
View remediation
other
Warning
- Location
scripts/extract-llm.py:154- Finding
Transcript-Derived Private Memories Can Be Automatically Pushed to a Git Remote
- Content
View full analysis
repo root try: import glob scene_files = glob.glob(os.path.join(scene_dir, "scene-*.md")) changed = [] for sf in scene_files: rel = os.path.relpath(sf, repo_dir) r2 = subprocess.run( ["git", "-C", repo_dir, "diff", "--quiet", rel], capture_output=True, timeout=5 ) if r2.returncode != 0: changed.append(rel) if not changed: ...[truncated 2936 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
- Rogue AgentSelf-Modification, Session Persistence
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (84)
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 96% confidence
- Finding
This finding highlights authenticated HTTP calls using configured tokens, continuous directory watching, and interaction with files outside the skill directory. Those are sensitive capabilities for a janitor-class skill because they create broader authority over live gateway state and can expose or alter operational data beyond simple transcript cleanup.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding highlights authenticated HTTP calls using configured tokens, continuous directory watching, and interaction with files outside the skill directory. Those are sensitive capabilities for a janitor-class skill because they create broader authority over live gateway state and can expose or alter operational data beyond simple transcript cleanup.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 99% confidence
- Finding
This finding highlights authenticated HTTP calls using configured tokens, continuous directory watching, and interaction with files outside the skill directory. Those are sensitive capabilities for a janitor-class skill because they create broader authority over live gateway state and can expose or alter operational data beyond simple transcript cleanup.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding highlights authenticated HTTP calls using configured tokens, continuous directory watching, and interaction with files outside the skill directory. Those are sensitive capabilities for a janitor-class skill because they create broader authority over live gateway state and can expose or alter operational data beyond simple transcript cleanup.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding highlights authenticated HTTP calls using configured tokens, continuous directory watching, and interaction with files outside the skill directory. Those are sensitive capabilities for a janitor-class skill because they create broader authority over live gateway state and can expose or alter operational data beyond simple transcript cleanup.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 98% confidence
- Finding
This finding highlights authenticated HTTP calls using configured tokens, continuous directory watching, and interaction with files outside the skill directory. Those are sensitive capabilities for a janitor-class skill because they create broader authority over live gateway state and can expose or alter operational data beyond simple transcript cleanup.
- Content
Tp4
High
- Category
- MCP Tool Poisoning
- Confidence
- 95% confidence
- Finding
This finding highlights authenticated HTTP calls using configured tokens, continuous directory watching, and interaction with files outside the skill directory. Those are sensitive capabilities for a janitor-class skill because they create broader authority over live gateway state and can expose or alter operational data beyond simple transcript cleanup.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
Automatic execution of restart scripts grants the skill process-control capability beyond its janitorial purpose. If the configuration is altered, the script paths are replaced, or stale-session detection is triggered incorrectly, the skill could execute unintended commands and disrupt service availability.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Configurable restart-script paths give this skill a path to trigger local command execution and service restarts, which is far beyond its stated housekeeping role. If an attacker can influence the config, filesystem, or janitor process, this creates a meaningful privilege and availability risk through arbitrary or unintended script execution.
- Content
Description-Behavior Mismatch
High
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
This skill goes beyond transcript trimming and local hygiene by automatically committing and pushing extracted memory content to a git remote. That materially expands the data exposure surface and can publish sensitive conversation-derived information outside the local system without a strong execution-time consent boundary.
- Content
Context-Inappropriate Capability
High
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Invoking git add/commit/push as part of a janitorial skill introduces networked side effects and state mutation that are not inherently necessary for transcript cleanup. In this context, the behavior is more dangerous because the content being pushed is generated from archived conversations and may include sensitive operational or personal details.
- Content
Missing User Warnings
High
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The script automatically commits and pushes scene-file updates containing extracted memories to git without a point-of-use warning or affirmative approval. This is especially dangerous in this skill context because janitorial maintenance would not normally imply remote publication of user-derived memory artifacts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
This markdown file states that the system 'aggressively' trims JSONL session files and offloads or removes transcript content, but it does not include a clear warning that user/session data will be rewritten and some historical details may be irreversibly reduced or deleted. For a skill description, these behaviors can affect user data and auditability, so an explicit warning is expected.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The documentation says archive cleanup deletes
.pre-trim.*files older than 7 days, but it does not present this as a user-facing warning about retention limits and eventual data deletion. Because this affects recoverability of prior session content, the markdown should explicitly disclose it.- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 76% confidence
- Finding
The design continuously watches active session files, stores dedup state, creates pre-trim archives, and preserves offloaded tool outputs in adjacent .toolcache directories. In a session-hygiene skill, this persistence is contextually expected, but it still increases the amount of sensitive conversational and tool-derived data retained on disk, expanding exposure if local files are accessed by other users, malware, or backups.
- Content
md - *Linux:* `inotifywait` in monitor mode (`inotify-tools` package) - *macOS:* `fswatch` with FSEvents backend (`brew install fswatch`) Both output one absolute path per line on write events. The rest of the flow is identical. Flow per JSONL write event: 1. JSONL file closes after a turn completes
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
After trim, the watcher sends a no-op message to the gateway:
bash curl http://127.0.0.1:<port>/v1/chat/completions \ -H "Authorization: Bearer <token>" \ -H "x-openclaw-session-key: <session-key>" \ -d '{"model":"openclaw","messages":[{"role":"user","content":"[session trimmed by maintenance — acknowledge with NO_REPLY]"}]}'
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README advertises automatic transcript trimming, archiving, pruning, orphan cleanup, and cron-based execution, but it does not clearly warn users that the tool modifies and deletes session data on a recurring basis. For an operational tool that acts on conversation history and session state, the absence of explicit destructive-action warnings increases the risk of unintended data loss, privacy issues, and unsafe deployment by users who assume the behavior is reversible or non-destructive.
- Content
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 89% confidence
- Finding
The skill declares no explicit tool restrictions even though the documented behavior clearly requires shell execution, filesystem reads/writes, background service installation, and network/API access. In an agent-skill ecosystem, missing scope declarations weakens least-privilege controls and can allow broader-than-expected execution if the runtime defaults are permissive.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The skill advertises automatic trimming, archiving, pruning, and deletion but does not provide a strong up-front warning about irreversible modification or retention effects. Users may enable it without realizing it can permanently alter transcripts and remove session artifacts, leading to data loss and forensic gaps.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The skill states that archived content may be sent to the gateway's chat completions API for memory extraction but does not present a clear privacy warning or consent-oriented notice. Shipping transcript content to an LLM endpoint can expose sensitive conversation data, especially in multi-gateway or shared environments.
- Content
Description-Behavior Mismatch
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
Embedding watchdog alerting and restart behavior inside a janitor skill increases privilege and broadens the blast radius of misconfiguration or abuse. If compromised or misused, the skill could move from maintenance tasks into service disruption, unauthorized notifications, or operational tampering.
- Content
Context-Inappropriate Capability
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
Slack alerting sends session-derived operational information to an external system that is not necessary for core transcript hygiene. This creates data exposure and covert-notification risk, especially if stale-session metadata or identifiers contain sensitive workflow details.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
macOS (launchd):
bash launchctl list | grep session-janitor launchctl unload ~/Library/LaunchAgents/ai.openclaw.session-janitor-watcher.plist launchctl load ~/Library/LaunchAgents/ai.openclaw.session-janitor-watcher.plist tail -f /tmp/session-janitor-watcher.log
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
macOS (launchd):
bash launchctl list | grep session-janitor launchctl unload ~/Library/LaunchAgents/ai.openclaw.session-janitor-watcher.plist launchctl load ~/Library/LaunchAgents/ai.openclaw.session-janitor-watcher.plist tail -f /tmp/session-janitor-watcher.log
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
macOS (launchd):
bash launchctl list | grep session-janitor launchctl unload ~/Library/LaunchAgents/ai.openclaw.session-janitor-watcher.plist launchctl load ~/Library/LaunchAgents/ai.openclaw.session-janitor-watcher.plist tail -f /tmp/session-janitor-watcher.log
Static analysis
No suspicious patterns detected.