Chat History Local

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:55 AM UTC
• Version: 1.0.0

Overview

The skill clearly does what it says, but it gives agents broad access to private chat history through an overpowered database connection without clear authorization controls.

Review before installing. This skill should only be used in an environment where the local audit database is intentionally available to the agent and the user is authorized to search the relevant chats. Prefer a read-only scoped database role, parameterized or fixed search commands, explicit confirmation before private-history lookups, and removal of real personal chat identifiers from examples.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:30

Finding

Database-Wide Chat Access Through a PostgreSQL Superuser Account

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:30-35
Vulnerability Type: Excessive database privileges and missing access-control boundaries
Risk Level: High

markdown

## Database Connection

- **Host**: 127.0.0.1, **Port**: 15432, **User**: postgres, **DB**: openclaw_audit
- **psql**: `LC_ALL=C /opt/homebrew/Cellar/postgresql@18/18.2/bin/psql -h 127.0.0.1 -p 15432 -U postgres -d openclaw_audit`
- **Important**: Must use PG 18 binary and `LC_ALL=C` prefix

Technical Analysis

The Skill instructs the agent to connect to the audit database using the PostgreSQL postgres account. This account is conventionally a database superuser and is not restricted to the read-only message-search operations required by the Skill.

The supplied query patterns allow database-wide searches and chat enumeration, but the Skill does not require requester authorization, chat ownership verification, row-level security, or filtering records to an authorized user. A LIMIT only restricts the number of rows returned by one query; it does not provide an access-control boundary.

The accessible schema contains private message bodies, phone numbers, sender identities, chat identifiers, session UUIDs, model information, and cost metadata. Consequently, compromise or misuse of this Skill can affect records beyond the conversation legitimately relevant to the requester.

Attack Path

1. A user asks the agent to enumerate chats or retrieve messages associated with another person, group, date, or keyword.
2. The agent follows the Skill and connects as the postgres database user.
3. The agent executes a broad query against messages, without verifying whether the requester is authorized to access the selected chats.
4. The query returns private messages and identifying metadata from unrelated conversations.
5. Because the connection uses a highly privileged account, an injected or mistakenly generated statement could potenti ...[truncated 519 chars]

Remediation

View remediation

Remediation Suggestions

• Replace the postgres account with a dedicated read-only role that can access only the required columns and rows.
• Revoke INSERT, UPDATE, DELETE, TRUNCATE, DDL, role-management, and database-administration privileges from the Skill account.
• Enforce PostgreSQL row-level security based on the authenticated requester's authorized chat identifiers.
• Require explicit authorization checks before searching, quoting, or replying to messages from a chat.
• Remove or disable database-wide chat enumeration for ordinary users.
• Expose a narrowly scoped search API or stored procedure instead of arbitrary SQL access.
• Redact phone numbers, session UUIDs, message IDs, and other identifiers unless they are essential to the authorized request.
• Enable audit logging and rate limits for message searches and repeated pagination.
• Configure sessions with default_transaction_read_only = on and a strict statement timeout as defense-in-depth controls.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:57

Finding

Unsafe Free-Form SQL Execution Through psql

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:57-62
Vulnerability Type: Unsafe SQL and shell command construction
Risk Level: High

markdown

## How to Run Queries

```bash
LC_ALL=C /opt/homebrew/Cellar/postgresql@18/18.2/bin/psql -h 127.0.0.1 -p 15432 -U postgres -d openclaw_audit -c "QUERY"

text

### Technical Analysis

The Skill directs the agent to insert a generated query into a shell command passed to `psql -c`. It does not require parameterized statements, escaping, an allowlist of supported query forms, or validation of user-controlled search terms.

Search requests naturally include attacker-controlled values such as names, phrases, dates, and chat identifiers. If these values are directly interpolated into a SQL literal, quote characters and SQL syntax can terminate the intended expression and introduce additional operations. If the entire command is assembled as shell text, incorrect handling of quotes or shell metacharacters may also create a command-injection path.

The severity is amplified because the documented connection uses the `postgres` account. A maliciously altered query would therefore execute with substantially more privileges than the read-only search task requires.

### Attack Path

1. An attacker submits a search term containing SQL delimiters or malicious SQL syntax.
2. The agent incorporates the term into a generated SQL query without using a bound parameter.
3. The resulting query is inserted into the quoted `psql -c` command.
4. The attacker-controlled syntax changes the meaning of the intended search statement.
5. The PostgreSQL server executes the altered statement under the `postgres` account.
6. Depending on server permissions and statement handling, the attacker can retrieve unrelated records, alter data, or perform privileged database operations.

A secondary path exists if command construction passes unescaped attacker input through a shell: shell metacharacter
...[truncated 619 chars]

Remediation

View remediation

Remediation Suggestions

• Do not permit the agent to construct arbitrary SQL or pass it directly to psql -c.
• Implement a fixed search wrapper or API with a small allowlist of supported operations.
• Use PostgreSQL bound parameters for every user-controlled value, including keywords, phrases, dates, phone numbers, and chat IDs.
• Pass commands as an argument array without invoking a shell.
• Validate dates and numeric limits against strict schemas and cap all result sizes server-side.
• Reject stacked statements and restrict the database role to SELECT on an approved view.
• Use stored procedures or prepared statements that return only the minimum required columns.
• Apply read-only transactions, statement timeouts, query-complexity limits, and database audit logging.

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:74

Finding

Hard-Coded Personal and Group Chat Identifiers

Content

View full analysis

Vulnerability Details

File Location: SKILL.md:74-84
Vulnerability Type: Plaintext exposure of personal identifiers
Risk Level: Medium

sql

### Search by chat
```sql
-- Roy's direct messages
SELECT id, ts, LEFT(body, 200) FROM messages 
WHERE chat_id = '[phone]' AND chat_type = 'direct'
ORDER BY ts DESC LIMIT 20;

-- A specific group
SELECT id, ts, sender_name, LEFT(body, 200) FROM messages 
WHERE chat_id = '[e-mail]'
ORDER BY ts DESC LIMIT 20;

Technical Analysis

The distributed Skill includes a real-looking international phone number, associates it with a named individual, and embeds a specific group-chat identifier. These are personal and conversational metadata rather than synthetic placeholders.

Anyone able to obtain the Skill can extract these identifiers without accessing the database. In an environment where the documented database connection is available, the identifiers also provide ready-made selectors for targeting the associated direct and group conversations.

Attack Path

1. An attacker obtains or reads the Skill package.
2. The attacker extracts the named person's phone number and the embedded group-chat identifier.
3. The attacker uses the supplied SQL patterns through the agent or another database client.
4. The database returns messages associated with the targeted direct conversation or group.
5. Repeated queries with adjusted limits or timestamps can reconstruct a larger portion of the conversation history.

Impact Assessment

The embedded data discloses a phone number, its association with a named person, and a specific group-chat identifier. When combined with database access, it enables targeted retrieval of message content, timestamps, sender information, and conversation metadata for those chats. Even without database access, publishing these identifiers creates privacy, correlation, profiling, and social-engineering risks.

Remediation

View remediation

Remediation Suggestions

• Remove all real phone numbers, personal names, message identifiers, and group-chat identifiers from the Skill.
• Replace examples with unmistakably synthetic placeholders such as [phone] and [e-mail].
• Resolve authorized chat identifiers at runtime from an authenticated identity and authorization service.
• Avoid logging or returning full identifiers when truncated or pseudonymous values are sufficient.
• Add automated secret and personal-data scanning to the packaging and release process.
• Review repository history and previously distributed packages, and remove or rotate exposed identifiers where the platform supports rotation.

SkillSpector

Vulnerability Patterns

• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill explicitly instructs the agent to search private WhatsApp/chat history stored in an audit database, but it provides no user-facing privacy notice, consent check, or authorization boundary before accessing that data. Because the data includes message bodies, sender identities, phone numbers, and chat metadata, misuse or overbroad activation could expose highly sensitive personal communications.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The skill is triggered by broad phrases like asking about what was discussed, what someone said, or referencing previous discussions, which can overlap with many normal user requests. In a system with access to private audit-log chat data, this increases the chance of unnecessary or unintended retrieval of sensitive historical messages without a clear, narrowly scoped user request.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.