Security audit

Session History Share

Security checks across malware telemetry and agentic risk

Overview

This skill is not evidently malicious, but it automatically stores and reuses prior conversation history, so users should review its privacy impact before installing.

Install only if you intentionally want OpenClaw to keep local summaries of prior sessions and inject them into later conversations. Avoid using it for sessions containing secrets, customer data, personal information, or unrelated projects unless you are comfortable with that context being retained and reused; review the cron job, OpenClaw hook registration, and .session_history files, and manually delete saved archives if you uninstall.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (12)

Context-Inappropriate Capability

Medium

Confidence: 95% confidence
Finding: The installer creates a persistent cron task that automatically enumerates active sessions, reads transcript files, summarizes their contents, writes retained history files, and deletes old archives. For an install script, this is a significant expansion of scope into ongoing data collection and retention, creating a durable privacy and confidentiality risk if users did not explicitly consent or understand the behavior.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The README explicitly describes automatic extraction of prior session history, storage to disk, and injection into new sessions, but it does not mention consent, opt-in behavior, data classification limits, or privacy warnings. This creates a real risk that sensitive user-provided content from one session will be silently propagated into later sessions and retained on disk beyond the user's expectation.

Missing User Warnings

Medium

Confidence: 94% confidence
Finding: The skill explicitly enables cross-session sharing of conversation history and writes summaries to disk, but the description does not clearly warn users that their transcript contents may persist beyond a single session. This creates a real privacy and consent problem because users may disclose sensitive information under the assumption that session boundaries limit retention and reuse.

Missing User Warnings

Low

Confidence: 88% confidence
Finding: The planned semantic retrieval features would increase the scope of historical data reuse by selecting prior content based on current conversation context, yet the documentation does not warn users about the added privacy implications. Even though this is forward-looking rather than active code, it signals intended handling of user data in a more invasive way without corresponding transparency.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The hook is designed to automatically inject prior session history into each new conversation context, but the documentation provides no user-facing warning or consent mechanism. This can expose sensitive data from earlier sessions unexpectedly and may cause privacy, data minimization, or cross-task confidentiality issues if users do not realize prior context is being carried forward.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The handler reads prior session history from a per-user disk location and silently injects it into BOOTSTRAP.md for the current run. This can expose sensitive data from previous conversations to the agent or downstream tools without explicit user awareness, consent, or contextual scoping, creating a privacy and data-leakage risk.

Missing User Warnings

Medium

Confidence: 97% confidence
Finding: The script silently modifies the user's OpenClaw configuration and attempts to register a scheduled task without confirmation. Silent persistence and configuration changes reduce user awareness and control, and in this case they enable recurring processing of potentially sensitive session data.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The skill's core feature is cross-session history sharing via automatic summary extraction and prompt injection into new sessions. In this context, that behavior is inherently sensitive because it can carry secrets, personal data, or confidential instructions from one session into another without strong user awareness or scoping controls, increasing the chance of unintended disclosure or model misuse.

Ssd 3

Medium

Confidence: 96% confidence
Finding: Cross-session history sharing and prompt injection of prior summaries means information disclosed in one session can appear in later sessions, including secrets, personal data, or context the user did not intend to carry forward. This breaks the usual expectation of session isolation and can cause unintended disclosure to later prompts, tools, or users sharing the same environment.

Ssd 3

Medium

Confidence: 97% confidence
Finding: The cron workflow directs collection of active session transcript content from JSONL files, summarization of that content, and retention in archive files. Persisting conversational content in additional files increases the attack surface for data leakage, unauthorized local access, accidental inclusion in backups/repos, and reuse outside the original session context.

Ssd 3

Medium

Confidence: 90% confidence
Finding: The planned semantic retrieval and persistent memory design would reuse historical user information based on current conversation semantics, which can surface sensitive prior content in new contexts without the user explicitly requesting it. This increases privacy risk because relevance-driven recall can expose old information more aggressively than simple session summaries.

Ssd 3

High

Confidence: 98% confidence
Finding: The cron message explicitly directs collection, summarization, and retention of conversation contents from all active sessions into per-session files. This creates a broad privacy exposure because sensitive prompts, responses, and operational context from unrelated sessions are aggregated into a local archive that may persist beyond the original session lifecycle.

VirusTotal

65/65 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

Detected: suspicious.dangerous_exec

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/install.sh:74

Shell command execution detected (child_process).

Critical

Code: suspicious.dangerous_exec
Location: scripts/uninstall.sh:65