Security audit
Security checks for vulnerabilities and agentic risk
This archive skill is mostly coherent, but it can copy and permanently retain sensitive session transcripts with unsafe selection and incomplete redaction safeguards.
Install only if you are comfortable with a Review-level skill that reads session transcripts and stores sanitized copies long term. Prefer the ClawHub/OpenClaw install path, require an explicit session identifier before archiving, manually inspect sanitized output before any Git commit, avoid storing unnecessary client contact details, and do not approve deletion unless the exact source files are shown.
SKILL.md:32Mutable Remote Payload Is Downloaded Without Integrity Verification
SKILL.md:92Ambiguous Transcript Selection Can Access and Archive an Unrelated Private Session
scripts/sanitize_transcript.py:91Best-Effort Sanitization Can Leave Credentials and Sensitive Data in Committed Archives
The README states that all deliverables are written in English regardless of client language preference. This is a language-policy constraint without user opt-in or a documented justification, which violates the stated policy requirements.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
(
r'\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}\b',
'[REDACTED-GITHUB-TOKEN]',
'GitHub personal access tokens (ghp_, gho_, ghu_, ghs_, ghr_)',
),
(
r'\b(github_pat_[A-Za-z0-9_]{22,})\b',
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
(
r'\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}\b',
'[REDACTED-GITHUB-TOKEN]',
'GitHub personal access tokens (ghp_, gho_, ghu_, ghs_, ghr_)',
),
(
r'\b(github_pat_[A-Za-z0-9_]{22,})\b',
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
(
r'\b(ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9_]{36,}\b',
'[REDACTED-GITHUB-TOKEN]',
'GitHub personal access tokens (ghp_, gho_, ghu_, ghs_, ghr_)',
),
(
r'\b(github_pat_[A-Za-z0-9_]{22,})\b',
The README advertises broad natural-language triggers like "archive this" and "can we archive this," which can easily match ordinary conversation rather than an explicit user command. In a skill that archives transcripts and updates memory/git state, accidental invocation could cause unintended collection, persistence, and commit of sensitive workspace data.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
git clone https://github.com/KaigeGao1110/ArchiveProject.git ~/.openclaw/skills/archive-project
curl -L https://github.com/KaigeGao1110/ArchiveProject/archive/refs/heads/main.zip -o /tmp/archive-project.zip unzip /tmp/archive-project.zip -d ~/.openclaw/skills/ mv ~/.openclaw/skills/ArchiveProject-main ~/.openclaw/skills/archive-project
The skill is designed to persist full session transcripts and child subagent transcripts into a long-term project archive, materially increasing retention of potentially sensitive conversations, secrets, and operational metadata. Even with sanitization, transcripts are high-risk artifacts because redaction can miss edge cases, and the archive centralizes sensitive history in a durable location.
workspace/projects/<project-name>/
The reference section states the sanitization script is 'Non-destructive: Original file is never modified' (L353-L355). However, the prescribed archive procedure immediately moves the sanitized file over the original transcript path (L151-L155), resulting in the original archived copy being replaced. This is a direct contradiction in the skill documentation about whether the original transcript remains intact.
Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.
"Can I delete the EFS session files for this project? They are already backed up in the archive."
Only proceed if the user explicitly approves. Never auto-delete without asking.
If approved:
The template explicitly instructs storing client contact information in long-term archive records without a clear data-minimization rule, consent requirement, or retention limit. This can cause unnecessary persistence of personal data and broaden the blast radius if the archive is later accessed or exposed.
Detected: suspicious.generated_source_template_injection