Security audit

MH session-logs

Security checks for vulnerabilities and agentic risk

Overview

The skill is read-only, but it gives agents broad access to complete historical chat logs without clear limits or consent guidance.

Install only if you are comfortable with an agent reading your OpenClaw session history. Use it with precise session IDs, dates, or phrases, and avoid using it in shared, multi-user, or multi-channel environments unless access to those historical chats is clearly authorized.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:13
Finding: Unrestricted Cross-Session Conversation Log Access
Content: View full analysis
/sessions/` (use the `agent=` value from the system prompt Runtime line). - **`sessions.json`** - Index mapping session keys to session IDs - **`.jsonl`** - Full conversation transcript per session ``` ```markdown ### Search across ALL sessions for a phrase ```bash rg -l "phrase" ~/.openclaw/agents//sessions/*.jsonl ``` ``` The document also supplies commands for enumerating every session and extracting user messages, assistant responses, tool calls, usage information, and other transcript content. ### Technical Analysis The skill instructs the agent to derive its agent identifier from the system prompt and directly inspect the complete session storage directory. It permits searches across every session rather than limiting access to a specifically identified parent conversation or an explicitly authorized session. Session transcripts may contain private user messages, assistant responses, tool output, operational metadata, credentials accidentally included in conversations, and information from unrelated channels or users. The skill does not define authorization checks, session-ownership validation, channel or tenant isolation, redaction, or data-minimization requirements before this content is accessed and returned. The commands are read-only and do not establish persistence, execute downloaded payloads, modify tools, or transmit data to a remote service. The risk instead arises from crossing logical access boundaries and exposing unrelated sensitive records. ### Attack Path 1. A user asks the agent about a prior conversation or supplies a phrase to search for. 2. The skill is activated because the request concerns historical context. 3. ...[truncated 1517 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 94% confidence
Finding: The skill explicitly instructs the agent to search complete session history, including older and parent conversations, but provides no user-facing consent, privacy notice, or access-control guidance. Because session logs may contain sensitive prior-user content, this creates a real privacy and data-minimization risk if the agent retrieves historical conversations beyond what the user reasonably expects in the current interaction.
Content: No source excerpt is available for this finding.