Security audit

Session History Enhanced

Security checks for vulnerabilities and agentic risk

Overview

The skill is mostly a coherent session-history feature, but its sample implementation has real risks around unscoped agent IDs, internal path exposure, and misleading deletion behavior for chat transcripts.

Review this before installing, especially if OpenClaw is exposed to multiple users or untrusted dashboard clients. The feature is useful and not clearly malicious, but it should validate agent IDs against configured agents, avoid returning internal file paths, make archive operations transactional or fail closed, and align deletion prompts with actual transcript deletion before being trusted with private chat history.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (4)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: references/INSTALL.md:56
Finding: Caller-Controlled Agent ID Enables Path Traversal Outside the Agent Directory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/backend-history-db.ts.txt:147
Finding: Archive Listing Exposes Internal Transcript File Paths
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/backend-session-archive.ts.txt:169
Finding: Fail-Open Archival Can Remove an Active Session After Archival Failure
Content: View full analysis
{ const { primaryKey } ...[truncated 2061 chars]
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: references/frontend-controllers-sessions.ts.txt:250
Finding: Permanent Delete Workflow Retains Transcript Files Contrary to User Confirmation
Content: View full analysis
{ if (!state.client || !state.connected) { return false; } const confirmed = window.confirm( `Delete archived session?\n\nThis will permanently delete the session and its transcript.`, ); if (!confirmed) { return false; } try { await state.client.request("sessions.deleteArchived", { sessionId }); // Reload archived sessions to reflect the change await loadArchivedSessions( state, undefined, state.archivedSessionsSearch || undefined, state.archivedSessionsPageSize, (state.archivedSessionsPage - 1) * state.archivedSessionsPageSize, ); return true; } catch (err) { state.archivedSessionsError = String(err); return false; } } ``` The backend defaults `deleteTranscript` to `false`: ```ts const { sessionId, agentId, deleteTranscript = false } = params; const config = loadConfig(); const resolvedAgentId = agentId ?? resolveDefaultAgentId(config); try { const sessionsDir = resolveSessionTranscriptsDirForAgent(resolvedAgentId); const historyDb = initHistoryDbWithMigration(sessionsDir, resolvedAgentId); const sessionRecord = historyDb .prepare(`SELECT * FROM session_history WHERE sessionId = ?`) .get(sessionId) as unknown; if (!sessionRecord) { respond(false, undefined, errorShape(ErrorCodes.NotFound, "Session not found", false)); return; } const filePath = (sessionRecord as { filePath?: string }).filePath; if (deleteTranscrip ...[truncated 1824 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 33)May include surrounding context.
md
| `src/config/sessions/history-db.ts` | [references/backend-history-db.ts.txt](references/backend-history-db.ts.txt) | SQLite CRUD operations |

Ae1

High

Category: analysis-evasion
Confidence: 100% confidence
Finding: Referenced artifact was not completely inspected
Content: Scanner excerpt · SKILL.md (reported line 49)May include surrounding context.
md
| `ui/src/ui/views/sessions.ts` | [references/frontend-views-sessions.ts.txt](references/frontend-views-sessions.ts.txt) | Full view with Session History sectio

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 89% confidence
Finding: The markdown describes sessions.deleteArchived as deleting archived sessions with an optional transcript deletion, which can affect user data. The file does not include any warning, confirmation note, or caution about irreversible data loss or the privacy implications of removing stored transcripts.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 93% confidence
Finding: This markdown installation guide introduces a sessions.deleteArchived capability, which is a destructive operation affecting user data. The document does not provide any warning about deletion risk, reversibility, or need for confirmation, despite describing user-facing Delete buttons elsewhere in the file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 90% confidence
Finding: This code moves transcript files into and out of an archive using fs.renameSync, which changes the user's session file state and can affect data availability. While there is error logging on failure, there is no confirmation prompt, user-facing disclosure, or explanatory comment/docstring warning that these operations relocate session transcripts.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The confirmation dialog says the archived session deletion will permanently delete the session and transcript, but the actual request only sends { sessionId } with no explicit transcript-delete flag or visible guarantee that the backend performs the same action. Mismatched destructive-action messaging can cause users to authorize operations under false assumptions, leading to unintended data retention or deletion and weakening trust and auditability around sensitive chat history management.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: This code provides destructive deletion buttons for archived sessions, and similarly for live sessions, without any confirmation prompt, warning text, or inline disclosure about permanence. For code files, destructive or irreversible operations should have some visible user disclosure unless clearly covered elsewhere, which is not evident in this file.
Content: No source excerpt is available for this finding.

Intent-Code Divergence

Low

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The documentation says this function lists archived sessions, but the implementation accepts an optional status filter and will return active sessions if opts.status is set to "active". This is an intent/documentation mismatch because the comment narrows behavior more than the code actually enforces.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 81% confidence
Finding: This code makes browser client requests to list sessions, including archived sessions metadata, but the function contains no confirmation, log, print, or explanatory comment disclosing that session data will be transmitted or fetched. For code files, user/system data network operations can warrant a warning unless the disclosure exists elsewhere or is clearly part of the stated skill purpose; no such disclosure is visible in this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 77% confidence
Finding: The patch operation transmits session identifiers and user-supplied updates to the backend, but there is no user-facing notice, print/log, or explanatory comment describing that remote session state will be changed. Although modification may be expected in context, that expectation is not documented within this file.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 74% confidence
Finding: Both resumeSession and renameSession issue backend requests that alter session state, but unlike the delete flows they provide no confirmation, visible notice, or explanatory comment. For code files, safety-relevant remote operations should have at least some disclosure when not otherwise documented.
Content: No source excerpt is available for this finding.

Missing User Warnings

Low

Category: Not specified by scanner
Confidence: 79% confidence
Finding: Archiving changes the state and location of a session, but the UI only provides a tooltip-like title and no explicit disclosure about what the operation does beyond moving to history. Because this is a state-changing operation affecting user session data, a clearer warning or explanatory text would improve safety and user awareness.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.