Security audit

Session回溯

Security checks for vulnerabilities and agentic risk

Overview

This skill is openly about session recall, but it gives broad access to private conversation history and persistent memory without clear user controls.

Review this carefully before installing. It should be limited to sessions the current user explicitly asks to search, avoid direct reads of deleted/reset records, remove the embedded session identifiers, and require confirmation before saving any conversation-derived memory.

A.I.G

Vulnerability Patterns

Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Error

Location: SKILL.md:35
Finding: Unrestricted Cross-Session and Deleted-Session Record Access
Content: View full analysis
/sessions/.jsonl ``` ```markdown 1. Determine the sessionId 2. Read the JSONL file: ~/.openclaw/agents/lin_xiaoman/sessions/.jsonl 3. Extract the required conversation segment 4. Tell the user about the content or add it to the current context ``` ```markdown - Reset records: ~/.openclaw/agents//sessions/.jsonl.reset. - Deleted records: ~/.openclaw/agents//sessions/.jsonl.deleted. ``` ### Technical Analysis The Skill instructs the agent to enumerate all available sessions, retrieve complete histories, and bypass session APIs by reading underlying JSONL files directly. It also identifies reset and deleted records as readable data sources. No instruction requires the agent to verify that the requesting user owns the target session, obtain explicit authorization, limit access to the current session, or exclude deleted records. Direct filesystem access may also bypass authorization, filtering, and audit controls implemented by `sessions_history`. Conversation histories can contain personal information, authentication material, confidential business data, private messages, and instructions from unrelated contexts. Treating a user-supplied ses ...[truncated 1474 chars]
Remediation: View remediation

T02 · Agent Memory Poisoning

Warning

Location: SKILL.md:9
Finding: Unvalidated Conversation Content Can Be Persisted as Long-Term Agent Memory
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: SKILL.md:91
Finding: Hard-Coded Live-Looking User and Session Identifiers in Published Skill Instructions
Content: View full analysis
Remediation: View remediation
::: ``` 3. Resolve the current session dynamically from trusted runtime context rather than from documentation. 4. Never interpret an example session key as an authorized retrieval target. 5. Scan release artifacts for user IDs, session IDs, local usernames, absolute paths, tokens, and other environment-specific values. 6. If the identifiers correspond to active records, assess whether the associated history was exposed and rotate or invalidate identifiers where supported. 7. Add a publication checklist requiring all examples to use synthetic data. ]]>

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (4)

Ssd 3

High

Category: Not specified by scanner
Confidence: 98% confidence
Finding: The skill tells the agent to persist conversation content, including 'learned information about the owner,' into memory for future use without limiting conditions, sensitivity screening, or user approval. Persisting personal details from chat into reusable memory materially increases privacy risk, profiling risk, and the chance of later unauthorized disclosure.
Content: No source excerpt is available for this finding.

Ssd 3

High

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill directs the agent to retrieve prior session history and relay selected content into the current conversation or to the user, effectively enabling cross-session replay of historical dialogue. Without strict identity, purpose, and consent checks, this can expose sensitive past statements, context from other conversations, or deleted/reset material that the user did not intend to resurface.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 95% confidence
Finding: The skill explicitly instructs the agent to extract 'important information,' including personal details about the user, and persist it into dated memory files without any consent check, minimization rule, or privacy warning. This creates a durable store of potentially sensitive conversational content that can outlive the original context and be reused in ways the user did not expect.
Content: No source excerpt is available for this finding.

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 96% confidence
Finding: The skill provides broad instructions for enumerating sessions and reading full historical records, including direct filesystem paths to JSONL logs, with no warning that these records may contain sensitive or deleted/reset content. This expands access to private conversation history and increases the risk of unnecessary exposure or disclosure across sessions.
Content: No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.