Clawdbot Logs Litiao

• Outcome: Review
• Latest audit: Sep 12, 2026 · 3:18 AM UTC
• Version: 1.0.0

Overview

The skill is mostly a coherent Clawdbot diagnostics helper, but it includes an overbroad command that can print raw user conversation history from all local session files.

Review before installing if your Clawdbot sessions may contain private, credential, business, or personal content. Use the metadata and timing scripts first; avoid the raw transcript parsing command unless you intentionally choose a specific session and are comfortable exposing its message contents to the agent context.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: SKILL.md:76

Finding

Overbroad Access to Private Conversation History

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 76-78
Vulnerability Type: Excessive access to sensitive session transcripts
Risk Level: Medium

Vulnerable Code

bash

tail -20 ~/.clawdbot/agents/main/sessions/*.jsonl | jq -r 'select(.message.role=="user") | .message.content[0].text' 2>/dev/null | tail -10

Technical Analysis

The documented diagnostic command uses the wildcard *.jsonl to read every session transcript in the main agent's session directory. It then extracts and displays raw user-message text.

This access is broader than necessary for the Skill's declared performance, response-time, error, token-usage, and API-cost diagnostics. Session transcripts may contain credentials, personal data, proprietary information, or conversations unrelated to the current diagnostic request. Displaying those messages also places them into terminal output and potentially the Agent's active context.

No network transmission or privilege-escalation mechanism was identified. The risk arises from crossing least-privilege and data-minimization boundaries through unnecessary access to sensitive local records.

Attack Path

1. A user or Agent loads the Skill to diagnose Clawdbot behavior.
2. The Agent follows the “Parse session file for recent messages” guidance in SKILL.md.
3. The shell expands ~/.clawdbot/agents/main/sessions/*.jsonl to all matching session transcripts.
4. tail reads records from those files.
5. jq selects user messages and extracts their raw text.
6. Sensitive content from unrelated sessions is exposed in command output and may enter the Agent's context.

Impact Assessment

An invocation can disclose private user-message contents from any readable transcript under the main agent's session directory. The scope is limited to files accessible under the invoking user's existing permissions; the code does not acquire elevated operating-system privileges.

Potentially exposed data includes personal informat ...[truncated 180 chars]

Remediation

View remediation

Remediation Suggestions

1. Remove the raw conversation-content command from the default diagnostic workflow.
2. Use metadata-only diagnostics wherever possible, such as timestamps, roles, message counts, token totals, durations, and error codes.
3. If message-body inspection is genuinely required, obtain explicit user consent and require selection of one specific session rather than using a wildcard.
4. Validate the selected session identifier and construct a single canonical file path confined to the expected session directory.
5. Redact credentials, tokens, personal data, and other secrets before printing content.
6. Limit output by record count and fields, and clearly warn that transcript inspection may reveal sensitive data.
7. Avoid placing raw transcript content into Agent context or persistent logs.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The skill explicitly directs access to full session files containing complete conversation history, token usage, costs, and likely other sensitive user content, but provides no warning, minimization guidance, or consent check. In a diagnostics skill, this is contextually relevant, but exposing broad log/session inspection commands without privacy guardrails increases the risk of unnecessary disclosure of sensitive data.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.