other
Warning
- Location
scripts/extract.js:19- Finding
Unrestricted Collection of Conversation History Across All Agents
- Content
View full analysis
{ return fs.statSync(path.join(AGENTS_DIR, f)).isDirectory(); }); for (const agent of agents) { const sessionsDir = path.join(AGENTS_DIR, agent, 'sessions'); if (!fs.existsSync(sessionsDir)) continue; const jsonlFiles = fs.readdirSync(sessionsDir).filter(f => f.endsWith('.jsonl')); for (const file of jsonlFiles) { if (file.includes(':run:')) continue; files.push(path.join(sessionsDir, file)); } } return files; } ``` ### Technical Analysis The extractor enumerates every directory under `~/.openclaw/agents` and collects every session file ending in `.jsonl`. It does not restrict collection to the current agent, an explicitly selected agent, or an allowlisted set of sessions. This behavior is disclosed in `SKILL.md`, so it is not covert. However, it violates data-minimization and least-access principles because performing a digest for one context can expose conversations belonging to unrelated agents. There is no consent check, sensitivity filter, credential redaction, or per-agent access control in the extraction logic. The resulting aggregation is especially sensitive because data distributed across multiple session files is consolidated into one artifact and subsequently intended to be read by a summarizing agent. Historical messages may contain credentials, private user information, internal paths, operational instructions, or other confidential material. ### Attack Path 1. An attacker or untrusted automation obtains the ability to invoke the skill under a user account that can read the OpenClaw agent directory. 2. The attacker executes `extract.js` for a date on which sensi ...[truncated 1055 chars]- Remediation
View remediation