Security audit
Security checks for vulnerabilities and agentic risk
This skill mostly matches a chat-history viewer, but it exposes sensitive local chat history and deletion actions through an unauthenticated web server that listens more broadly than documented.
Review before installing. Run it only on trusted machines and networks, avoid background mode unless needed, do not expose or forward the port, and treat all viewed or exported history as sensitive. The deletion feature can permanently remove chat history and backups, and the current server should be considered unsafe for shared hosts or reachable network environments without hardening.
scripts/history_server.py:2321Unauthenticated Network Exposure and Destructive Access to Sensitive Chat History
This mismatch is more severe because the analysis indicates undeclared deletion and modification capabilities, including rewriting session indexes and removing history files. Users invoking a 'viewer' would not reasonably expect destructive operations, so this creates risk of silent data loss or tampering of sensitive audit/history data.
This mismatch is more severe because the analysis indicates undeclared deletion and modification capabilities, including rewriting session indexes and removing history files. Users invoking a 'viewer' would not reasonably expect destructive operations, so this creates risk of silent data loss or tampering of sensitive audit/history data.
The skill is described as a history viewer/exporter, but it also exposes deletion of session and backup files through a POST API. This is a dangerous capability mismatch: users may invoke or trust the skill for read-only browsing, while the server can permanently destroy local conversation data if accessed by the UI or any local process able to reach the endpoint.
The code implements irreversible file deletion for active sessions, reset backups, and manual backups, which is not justified by the stated purpose of a history viewer. Even though deletion is keyed by session ID rather than arbitrary path input, exposing destructive actions over HTTP increases the chance of accidental data loss or abuse by other local software/users on the host.
The README explicitly documents API endpoints and curl commands to export complete session histories, but provides no warning that chat logs may contain secrets, personal data, tokens, or other sensitive content. In the context of a local history viewer that aggregates active sessions and backup/reset files, this omission increases the chance users will expose or mishandle highly sensitive conversation data.
The skill advertises capabilities that read local chat history, write backups, and launch a local web service, but it does not declare any explicit tool scope such as file or network permissions. That weakens user and platform visibility into what the skill can access and increases the chance of unintended exposure of sensitive conversation data.
Overly broad trigger phrases like '查看历史' or '打开聊天记录' can cause accidental activation during ordinary conversation. Because this skill exposes sensitive chat history and may start a local service, unintended invocation increases privacy and data-exposure risk even without overtly malicious intent.
The documentation does not warn users that browsing or exporting chat history may reveal sensitive prompts, secrets, tool outputs, or personal information. For a history viewer, omission of this warning materially increases the chance that users expose private data through the UI or API without realizing the risk.
The description and invocation guidance are presented in Chinese, effectively imposing a specific language on users without stating that the skill is region-specific or offering an alternative language. Under the stated policy, forcing a language without user opt-in is a natural-language policy concern.
The natural-language startup examples encourage ambiguous activation without making the privacy implications clear. In context, this is more dangerous because the skill targets historical conversations, which commonly contain credentials, personal data, and internal reasoning traces.
The documented use of nohup/background execution creates persistent local service behavior that may continue exposing chat history after the user forgets it is running. In a history-viewer context, persistence expands the window for unauthorized local access, stale data exposure, and unnoticed retention in log files such as /tmp/history.log.
nohup python3 ~/.openclaw/skills/openclaw-history-viewer/scripts/history_server.py > /tmp/history.log 2>&1 &
The module docstring and CLI usage text are written in Chinese, and later user-facing status/error messages are also emitted in Chinese only. This imposes a specific language on users without opt-in or justification, which matches the language/locale policy violation category.
This server exposes full chat history over HTTP from localhost bindings without any authentication, warning banner, or disclosure about the sensitivity of the data being served. In the context of chat/session archives, this can leak highly sensitive prompts, responses, tool outputs, or secrets to any local user/process, and potentially to a wider network if the service is reachable through host/network configuration.
The deletion API relies mainly on browser-side confirmation and prints minimal console messages, but provides no robust server-side consent recording, authentication, or durable audit trail for destructive actions. That makes accidental or unauthorized local deletions harder to detect, investigate, or attribute after the fact.
The README presents all user-facing instructions in Chinese and does not offer an alternative language, opt-in, or justification for a locale-specific audience. This can be a natural-language policy issue when a skill effectively forces a specific language without documented user choice.
This manifest file contains a natural-language field that is only in Chinese, which can impose a specific language on users or maintainers without opt-in. The policy calls for flagging language or locale constraints when they are forced and not explicitly justified.
This file contains extensive natural-language UI strings and comments in Chinese, and the generated HTML declares zh-CN as the page language. Because the skill does not offer any language selection or explain that it is intentionally region-specific, it violates the language/locale choice policy described for natural-language content.
The script's user-facing strings are written in Chinese, including startup and usage messages. This imposes a specific language on users without offering a language choice or documenting a locale-specific scope, which matches the language/locale policy concern.
No suspicious patterns detected.