OpenClaw Session Cleanup

• Outcome: Review
• Latest audit: Sep 16, 2026 · 5:41 AM UTC
• Version: 1.0.0

Overview

The skill has a legitimate cleanup goal, but it tells users to run an unbundled relative PowerShell script that could modify or delete OpenClaw session and conversation-history data.

Review this skill carefully before installing. Only run a cleanup script if you know exactly where it came from, inspect it first, run a dry run from a trusted path, and back up sessions.json and any conversation history before using options that delete .jsonl files.

A.I.G

Vulnerability Patterns

• Tool Hijacking and Spoofing: Modifies or replaces tools so legitimate-looking calls execute attacker logic
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T07 · Tool Hijacking and Spoofing

Error

• Location: SKILL.md:54

Finding

Untrusted Relative PowerShell Script Execution

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 54-60
Vulnerability Type: Untrusted relative script resolution
Risk Level: High

Vulnerable Code

powershell

### Step 2: Run cleanup script
```powershell
.\cleanup.ps1             # Clean the sessions.json index; retain .jsonl files by default
.\cleanup.ps1 -DryRun     # Preview changes without modifying files
.\cleanup.ps1 -KeepJsonl  # Explicitly retain .jsonl history files
.\cleanup.ps1 -CleanJsonl # Dangerous: delete .jsonl files and conversation history

text

The project contains only `SKILL.md`; the referenced `cleanup.ps1` script is not included.

### Technical Analysis

The Skill instructs the user or agent to execute `.\cleanup.ps1`, which PowerShell resolves relative to the current working directory. Because the project does not supply or authenticate this script, the command may execute an unrelated or attacker-controlled file with the expected name.

There is no absolute Skill-owned path, signature verification, checksum validation, provenance check, or inspection requirement before execution. The `-DryRun` option does not mitigate this issue because it is merely an argument passed to the selected script; a malicious script can ignore it.

This is classified as tool hijacking and spoofing because an attacker can provide a malicious script under the trusted `cleanup.ps1` name, causing a legitimate-looking invocation to execute attacker logic.

### Attack Path

1. An attacker gains the ability to place or replace `cleanup.ps1` in the directory from which the documented command will be run.
2. The victim invokes the Skill to resolve slow OpenClaw startup or session accumulation.
3. Following the instructions, the victim stops the OpenClaw gateway.
4. The victim or agent executes `.\cleanup.ps1`, optionally with one of the documented arguments.
5. PowerShell resolves the relative path to the attacker-controlled script.
6. The 
...[truncated 954 chars]

Remediation

View remediation

Remediation Suggestions

1. Include the reviewed cleanup.ps1 implementation in the Skill package rather than referring to an absent script.
2. Resolve the script from a fixed, absolute path beneath the trusted Skill installation directory. Do not depend on the caller's current working directory.
3. Before execution, verify that the resolved path remains inside the expected Skill directory and is a regular file rather than a symbolic link or reparse-point redirection.
4. Publish and validate a cryptographic checksum or trusted code signature for the script. Abort execution if validation fails.
5. Display the resolved script path and require explicit confirmation before running it.
6. Make dry-run mode the required first step, while recognizing that dry-run arguments are trustworthy only after script provenance has been verified.
7. Back up sessions.json atomically before modification and provide a documented restoration procedure.
8. Require separate, explicit confirmation for .jsonl deletion and restrict deletion to canonicalized paths within the expected OpenClaw data directory.
9. Run the cleanup with the least-privileged account necessary and reject execution under an elevated administrator context unless elevation is demonstrably required.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (2)

Hidden Instructions

High

• Category: Prompt Injection
• Confidence: 60% confidence

Finding

Hidden instructions were detected in comments or invisible text. These could contain malicious directives. Manual review is recommended.

Content

Scanner excerpt · SKILL.md (reported line 1)May include surrounding context.

md

---
name: openclaw-session-cleanup
description: >
  Clean up accumulated subagent and cron:run child sessions in OpenClaw to fix slow subagent startup.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill text says that when users mention certain triggers in Chinese, the skill 'must' be used, which can override normal user-choice and language-preference handling. While not directly enabling code execution or data exfiltration, this is a policy/compliance issue because it may force Chinese-language behavior or workflow selection without explicit opt-in.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.