Security audit

Session Memory Extractor

Security checks across malware telemetry and agentic risk

Overview

This skill has a coherent session-cleanup purpose, but it handles highly sensitive session data and credentials with enough under-disclosed network and deletion behavior that users should review it carefully before installing.

Install only if you are comfortable giving this skill access to old OpenClaw session transcripts and local OpenClaw MiniMax credentials, and with sending transcript content to MiniMax for extraction. Use preview first, avoid enabling Feishu notifications unless the target is trusted, review extracted memory for secrets, and be aware that normal runs can permanently delete original session files after successful extraction.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Behavioral ASTexec() Call, eval() Call, Dynamic Import
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands

Findings (16)

subprocess module call

Medium

Category: Dangerous Code Execution
Content: print(f"[AI] Extracting... {SESSION_ID}") try: result = subprocess.run( ["python3", extract_script, "--session-id", SESSION_ID, "--content", content,
Confidence: 86% confidence
Finding: result = subprocess.run( ["python3", extract_script, "--session-id", SESSION_ID, "--content", content, "--model", model], capture

Intent-Code Divergence

Medium

Confidence: 90% confidence
Finding: The documentation inconsistently describes `--dry-run` as a preview mode even though elsewhere it is defined to perform extraction and write memory. In a tool that processes sensitive sessions and may later delete originals, this semantic confusion can cause users to run a mutating operation when they expected a read-only preview, leading to unintended data disclosure into memory/ or downstream cleanup mistakes.

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The script extracts an API token directly from the agent's local SQLite auth store and reuses it for a subprocess. That expands the skill's authority beyond simple file recovery into credential access, and it does so implicitly without clear user consent or scope restriction.

Description-Behavior Mismatch

Medium

Confidence: 91% confidence
Finding: The skill description focuses on extraction and cleanup, but the code also rewrites sessions.json to remove session records. This is an undocumented state-changing action that can alter agent behavior, hide history, or make recovery harder if the deletion logic is wrong.

Context-Inappropriate Capability

High

Confidence: 98% confidence
Finding: The skill actively reads the main agent's credential stores, including auth-profiles.json and openclaw-agent.sqlite, to obtain MiniMax API credentials. That exceeds the minimally necessary scope for local session-file processing and creates a privilege boundary violation: the skill can silently repurpose another component's secrets to authenticate outbound requests.

Description-Behavior Mismatch

Medium

Confidence: 95% confidence
Finding: The script sends session-derived summaries and snippets to Feishu/OpenClaw, but the skill description emphasizes local extraction and cleanup and does not clearly disclose external transmission. Because the message includes extracted memory content previews, this creates a meaningful data-exfiltration/privacy risk if operators assume the tool is purely local.

Context-Inappropriate Capability

Medium

Confidence: 90% confidence
Finding: Network/webhook messaging capability is broader than what is necessary for a local session-memory extraction/cleanup utility and expands the attack surface. In context, the dangerous aspect is not the existence of notifications alone, but that extracted session information can be transmitted off-host through external channels.

Description-Behavior Mismatch

Medium

Confidence: 94% confidence
Finding: The script can send a generated extraction report to Feishu, creating an outbound data flow that is not part of the stated local session-extraction/cleanup purpose. Because the report is derived from prior sessions and memory extraction activity, it may contain sensitive operational metadata or summarized user content, so this expands the trust boundary and can leak data externally.

Context-Inappropriate Capability

Medium

Confidence: 92% confidence
Finding: The outbound notification path is unrelated to the core local file-processing behavior and introduces an unnecessary exfiltration channel. Even if intended for convenience, sending reports to an external service can disclose filenames, agent identifiers, timestamps, counts, or extracted memory summaries beyond the local environment.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The script silently reads credentials from local storage and passes them to a child process as MINIMAX_API_KEY. Even if used for legitimate extraction, this creates an undisclosed credential handling path that can leak secrets through subprocesses, logs, crashes, or future code changes.

Missing User Warnings

Medium

Confidence: 89% confidence
Finding: The script irreversibly deletes trajectory files and related session artifacts after extraction, with no confirmation prompt and no trash/backup mechanism. In a tool that processes potentially sensitive session history, a parsing mistake, model failure, or race condition could cause permanent data loss.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: This code sends raw session transcript content to an external MiniMax endpoint for processing. Session transcripts commonly contain sensitive prompts, user data, internal reasoning, tool outputs, and secrets, so transmitting them off-device without an explicit warning or consent mechanism introduces a substantial confidentiality risk.

Missing User Warnings

Low

Confidence: 89% confidence
Finding: The extractor reads credential material from local auth stores without any user-facing notice or consent in this file. Even if used only for API authentication, silent secret access is security-sensitive because it normalizes cross-component credential reuse and can expose tokens through misuse, logs, or future code changes.

Missing User Warnings

Medium

Confidence: 96% confidence
Finding: The generated Feishu message contains top extraction snippets derived from prior sessions, which may include sensitive preferences, facts, or decisions. Sending this content externally without explicit user warning or affirmative opt-in materially increases the chance of unauthorized disclosure of session data.

Ssd 3

Medium

Confidence: 94% confidence
Finding: Recovered conversation content is automatically appended to a persistent markdown memory file, creating a durable copy of potentially sensitive user data in plain language. This increases retention, broadens exposure to anyone or any tool with workspace access, and may duplicate secrets that were originally confined to session logs.

Ssd 3

Medium

Confidence: 93% confidence
Finding: The extraction prompt explicitly asks the model to retain and emit decisions, preferences, facts, and TODOs from session transcripts. In context, that means potentially sensitive personal or organizational information is summarized into durable memory output, increasing persistence and discoverability of data that may have been safer remaining transient.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.exposed_secret_literal

File appears to expose a hardcoded API secret or token.

Critical

Code: suspicious.exposed_secret_literal
Location: extract_session.py:139