ClawHub
Back to skill

Security audit

Session Cleaner

Security checks across malware telemetry and agentic risk

Overview

This skill is a disclosed OpenClaw session cleanup helper, but users should review the deletion list because it can remove local session history.

Install only if you want an agent to help clean OpenClaw session records. Before approving any cleanup, review which agents, sessions, and files will be removed, back up important session data, and do not approve deletion of running sessions or history you may need later.

SkillSpector

By NVIDIA
Vulnerability Patterns
  • Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (3)

Vague Triggers

Medium
Confidence
90% confidence
Finding
The documented trigger phrases are very broad, natural-language requests like '清理会话' and '删除旧 session', which can match ordinary user intent without confirming scope, target agent, or dry-run behavior. In a destructive cleanup skill, unintended activation could lead to deletion of session metadata and files that the user did not explicitly mean to remove.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The phrase '清理子 Agent' is ambiguous and does not clearly distinguish between listing child-agent sessions and deleting them. In a skill designed to clean up sessions, such ambiguity increases the risk of unintended destructive actions against agent state or session history, especially if users mean organization rather than deletion.

Vague Triggers

Medium
Confidence
93% confidence
Finding
The phrase '清理子 Agent' is ambiguous and does not clearly distinguish between listing child-agent sessions and deleting them. In a skill designed to clean up sessions, such ambiguity increases the risk of unintended destructive actions against agent state or session history, especially if users mean organization rather than deletion.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.