Security audit

FTS5 Session Search

Security checks across malware telemetry and agentic risk

Overview

This skill is a local session-log search tool, but it can persist and reveal broad private conversation history with limited privacy controls or user-facing warnings.

Install only if you are comfortable creating a local searchable copy of your OpenClaw conversation history. Set SESSIONS_ROOT and SEARCH_AGENTS narrowly, avoid logs that may contain secrets, protect or delete scripts/search.db when finished, and treat search output as sensitive.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (4)

Lp3

Medium

Category: MCP Least Privilege
Confidence: 82% confidence
Finding: The skill advertises search functionality but appears to exercise broader capabilities including environment access, file read/write, and shell use without declaring permissions. Undeclared powerful capabilities reduce transparency and can enable unexpected access to local data or execution pathways if the skill is invoked in a trusted context.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 93% confidence
Finding: The documented purpose is narrow search over session logs, but the analyzed behavior is materially broader: maintaining a local index, retrieving full conversations, extracting context, and indexing system and '[thinking]' content. This mismatch is dangerous because users may grant trust based on the description while the skill processes and exposes more sensitive data than expected, increasing the risk of privacy leakage and over-collection.

Vague Triggers

Medium

Confidence: 76% confidence
Finding: A broad trigger phrase can cause the skill to activate in situations beyond the user's clear intent, especially for generic search-related prompts. Because this skill can access and index session content, overbroad activation increases the chance of unintended data retrieval or background indexing of sensitive logs.

Missing User Warnings

Medium

Confidence: 90% confidence
Finding: The integration layer directly exposes search results from past conversation logs and returns raw message content without any access control, consent check, redaction, or user-facing disclosure that historical session data is being searched. In this skill's context, the entire purpose is cross-session log search, which increases the likelihood of retrieving sensitive prompts, secrets, personal data, or internal operational context from prior conversations.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Static analysis

Detected: suspicious.dynamic_code_execution

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/integration.py:25

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/search-cron.py:25

Dynamic code execution detected.

Critical

Code: suspicious.dynamic_code_execution
Location: scripts/test_search.py:30