Security audit

Session Recall

Security checks across malware telemetry and agentic risk

Overview

This is a legitimate session-recall tool, but it can expose sensitive past conversations across local agents without clear consent or scope controls.

Install only if you are comfortable with agents searching local OpenClaw transcript history. Use explicit --agent and narrow --start/--end filters, avoid all-agent searches unless intended, and treat recalled transcript text as private historical context, not as trusted new instructions.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 95% confidence
Finding: The skill directs the agent to read session transcript files and exposes file-reading capability, but it declares no permissions or boundaries for that access. In a memory-recall skill, this is especially risky because transcript files can contain sensitive user data, secrets, or unrelated prior conversations, and the lack of explicit permission scoping makes overbroad access more likely.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The README explicitly promotes searching past transcripts and even other agents' sessions, but provides no warning about privacy boundaries, authorization, or consent requirements. In a skill whose purpose is recovering conversation history, cross-session and cross-agent access materially increases the chance of unauthorized disclosure of sensitive prior user data, secrets, or internal deliberations.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README says the skill triggers automatically when context is missing, but does not mention notifying the user that historical transcripts may be searched and read. Automatic invocation in this context makes the privacy risk more acute because the agent may inspect prior conversation data without transparency, potentially surprising users and exposing sensitive material from previous sessions.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill instructs searching past session transcripts to recover context without warning that this may access privacy-sensitive historical data. Because it says the skill MUST be used before asking the user to repeat themselves, it normalizes silent retrieval of prior conversation content and can undermine user expectations about consent and data minimization.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The guidance to scan session previews can expose snippets from prior conversations before relevance is established, which may leak sensitive content through titles, first messages, or previews alone. In a transcript-search skill, preview-based triage increases the chance of incidental disclosure, especially when multiple sessions or agents are searchable.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The skill enumerates and searches prior session transcripts across agents and prints matching user/assistant content snippets directly to stdout without any consent check, scope restriction, or privacy notice. Because the skill is explicitly designed to recover prior context, it increases the chance that sensitive data from unrelated or broader historical conversations is surfaced to the calling agent or operator, creating a real confidentiality risk if invoked inappropriately.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.