ClawHub
Back to skill

Security audit

chatpipe-export

Security checks for vulnerabilities and agentic risk

Overview

This chat-export skill is not clearly malicious, but it overpromises what it can do and handles sensitive chat transcripts with weak safeguards.

Review before installing. Only use this skill if you trust the local ChatPipe file it executes and are comfortable with chat transcripts being written under ~/.openclaw/workspace. Prefer a revised version that accurately documents stdin-only input or implements scoped session retrieval, requires confirmation before export, pins or bundles ChatPipe, and uses private unique temporary files with cleanup on failure.

A.I.G

Vulnerability Patterns
  • Tool Hijacking and SpoofingModifies or replaces tools so legitimate-looking calls execute attacker logic
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)

T07 · Tool Hijacking and Spoofing

Error
Location
scripts/export_session.py:21
Finding

Execution of an Unverified Mutable Workspace Tool

Content
View full analysis

Vulnerability Details

File Location: scripts/export_session.py, lines 21–22 and 55–63
Vulnerability Type: Unverified local tool execution
Risk Level: High

Vulnerable Code

python
WORKSPACE = os.path.expanduser("~/.openclaw/workspace")
CHATPIPE = os.path.join(WORKSPACE, "products/chatpipe/chatpipe.py")
python
# Run chatpipe
out_dir = WORKSPACE
cmd = [
    sys.executable, CHATPIPE,
    temp_path,
    "-o", output_format,
    "-d", out_dir,
]
if title:
    cmd.extend(["--title", title])

result = subprocess.run(cmd, capture_output=True, text=True)

Technical Analysis

The script executes chatpipe.py from a mutable location outside the audited Skill package. It only verifies that the path exists; it does not verify the file's ownership, permissions, trusted origin, version, or cryptographic integrity.

Although the subprocess invocation uses an argument list and therefore does not directly introduce shell-command injection, Python will execute whatever code is present at the configured path. A local process or user capable of replacing or modifying ~/.openclaw/workspace/products/chatpipe/chatpipe.py can cause attacker-controlled Python code to run under the identity invoking the Skill.

The external process also receives the path to the temporary transcript file, giving a substituted tool direct access to the conversation being exported.

Attack Path

  1. An attacker obtains write access to ~/.openclaw/workspace/products/chatpipe/chatpipe.py or one of its writable parent directories.
  2. The attacker replaces the expected ChatPipe implementation with malicious Python code.
  3. A user or Agent invokes the session-export Skill.
  4. The script constructs a command using the unverified workspace path.
  5. subprocess.run() launches the substituted script with the invoking user's privileges.
  6. The malicious script can read the supplied transcript and access oth ...[truncated 671 chars]
Remediation
View remediation

Remediation Suggestions

  • Bundle the required ChatPipe implementation with the Skill so that the reviewed code is the code that executes.
  • Alternatively, install a pinned and verified dependency through a controlled package-management process.
  • Before execution, validate the target's canonical path, ownership, and permissions.
  • Reject tools located in directories writable by untrusted users or processes.
  • Verify the executable against a trusted cryptographic digest or signed manifest.
  • Execute the converter with the minimum filesystem and process privileges required.
  • Where practical, isolate conversion in a sandbox that only exposes the input file and designated output directory.
  • Fail closed if any integrity or permission check fails.

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/export_session.py:37
Finding

Predictable and Unsafely Managed Temporary Transcript File

Content
View full analysis

Vulnerability Details

File Location: scripts/export_session.py, lines 37–40 and 82–83
Vulnerability Type: Unsafe temporary-file handling and plaintext sensitive-data exposure
Risk Level: Medium

Vulnerable Code

python
if raw_input:
    temp_path = os.path.join(WORKSPACE, "temp_session_export.json")
    with open(temp_path, "w", encoding="utf-8") as f:
        f.write(raw_input)
python
# Clean temp
os.remove(temp_path)

Technical Analysis

Every export uses the fixed path ~/.openclaw/workspace/temp_session_export.json. Opening that predictable path with mode "w" follows symbolic links and truncates an existing target. The implementation does not create the file atomically, check whether it is a symbolic link, enforce restrictive permissions explicitly, or generate a unique name for concurrent runs.

Consequently, an attacker with sufficient access to manipulate entries in the workspace can pre-create the path as a symbolic link to another file writable by the invoking user. The subsequent open() operation will follow that link and overwrite the linked file with transcript data.

The predictable filename also causes concurrent exports to share one file. One invocation may overwrite or delete another invocation's input, potentially exposing one transcript to the wrong conversion process or causing corrupted output.

Cleanup occurs only on the success path. Exceptions during subprocess execution, output processing, renaming, or cleanup itself can leave the plaintext transcript in the workspace. Error return paths after ChatPipe fails also return before os.remove(temp_path) is reached.

Attack Path

Symlink overwrite scenario:

  1. An attacker who can modify the workspace creates temp_session_export.json as a symbolic link to a file writable by the Skill's user.
  2. The user pipes a conversation transcript into the export script.
  3. open(temp_path, "w") follows ...[truncated 1443 chars]
Remediation
View remediation

Remediation Suggestions

  • Create temporary files with tempfile.NamedTemporaryFile, tempfile.mkstemp, or a private TemporaryDirectory.
  • Generate a unique temporary path for every invocation.
  • Ensure temporary files are created atomically with permissions limited to the invoking user, such as mode 0600.
  • Avoid following symbolic links when platform APIs permit, including use of O_NOFOLLOW with low-level file creation where appropriate.
  • Place temporary transcript files in a private directory that is not writable by other users.
  • Wrap creation, conversion, and output handling in try/finally so cleanup occurs on success, converter failure, and exceptions.
  • Account for concurrent executions and never reuse a process-global fixed filename.
  • Minimize the period during which plaintext transcripts exist on disk.

SkillSpector

Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Behavioral ASTexec() Call, eval() Call, Dynamic Import
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (8)

Tp4

High
Category
MCP Tool Poisoning
Confidence
91% confidence
Finding

The skill promises broad import/export and session-handling behavior that is not actually evidenced by the implementation described in the finding. This mismatch can mislead users and calling agents into providing sensitive chat archives or assuming safe, automatic handling paths that do not exist, which can result in failed exports, unsafe manual workarounds, or accidental overexposure of data.

Content

No source excerpt is available for this finding.

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
89% confidence
Finding

The skill instructs the agent to run shell commands and create exported files, but it declares no tool scope or permissions boundary. That makes the capability implicit rather than explicitly constrained, increasing the chance of unauthorized file writes or command execution when the skill is invoked.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
84% confidence
Finding

The invocation guidance tells the agent when to use the skill but does not clearly limit activation scope or specify when not to invoke it. Without exclusion conditions, an agent may over-apply the skill and export data from the wrong session or at the wrong time, which is especially sensitive for conversation history.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium
Category
Not specified by scanner
Confidence
95% confidence
Finding

Broad trigger phrases like common requests to save or export a conversation can cause the skill to activate in situations where the user did not intend a file-export operation. In this context, unintended invocation is risky because the action writes potentially sensitive chat history into workspace files, creating persistent copies.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The skill lacks a prominent warning that exporting chat history creates new files containing potentially sensitive conversation data in the workspace. Users may not realize that secrets, personal data, or proprietary content from the chat will be copied into persistent storage, increasing exposure to other tools, processes, or collaborators with workspace access.

Content

No source excerpt is available for this finding.

Intent-Code Divergence

Medium
Category
Not specified by scanner
Confidence
96% confidence
Finding

The usage examples and docstring imply a one-click exporter that can operate on the current session or a provided session key. However, the implementation only reads stdin, prints an error when no piped data is present, and uses the session key only for output filename construction, so the documentation actively misrepresents the script's behavior.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium
Category
Not specified by scanner
Confidence
93% confidence
Finding

The manifest describes exporting 'any AI chat session' with support for 7 input formats including ChatGPT, Chatbox, Hermes, and OpenClaw sessions. In contrast, this script does not ingest those source formats directly or fetch a session by key; it only reads already-prepared JSON from stdin and otherwise exits, which is materially narrower than the advertised behavior.

Content

No source excerpt is available for this finding.

subprocess module call

Medium
Category
Dangerous Code Execution
Confidence
70% confidence
Finding

subprocess module calls execute external commands. Without careful input validation, this enables command injection.

Content

Scanner excerpt · scripts/export_session.py (reported line 62)May include surrounding context.

python
if title:
        cmd.extend(["--title", title])

    result = subprocess.run(cmd, capture_output=True, text=True)
    print(result.stdout)
    if result.returncode != 0:
        print(result.stderr)

Static analysis

No suspicious patterns detected.