ClawHub
Back to skill

Security audit

OpenClaw Session Grep

Security checks for vulnerabilities and agentic risk

Overview

The skill is openly meant to search local OpenClaw history, but it gives an agent broad access to potentially sensitive transcripts and possibly non-transcript files through an external CLI.

Install only where the agent is allowed to inspect prior OpenClaw transcripts. Treat searches as sensitive, use narrow time/session/channel filters, avoid broad --path values, and do not use this for general filesystem or repository search unless you have reviewed the ocgrep wrapper’s access controls.

A.I.G

Vulnerability Patterns
  • Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:13
Finding

Unrestricted Search of Sensitive Session and Transcript History

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 13-18
Vulnerability Type: Sensitive local history access
Risk Level: Medium

Code Snippet:

markdown
Default command:

```bash
/root/.openclaw/workspace/tools/ocgrep "keyword" --last 7d --open
text

### Technical Analysis

The skill directs the agent to search and open local OpenClaw session and transcript history. Such records may contain private conversations, credentials, tool arguments, operational details, or other information originally supplied in a different context.

The `--open` option requests exact file and line references, facilitating direct access to matching records. The skill does not document authorization checks, session ownership validation, output redaction, or restrictions limiting searches to records the current user is permitted to inspect.

The behavior is explicitly documented and does not itself prove malicious intent or external exfiltration. Nevertheless, it creates a least-privilege and privacy risk when the skill is available to an agent or user who should not have unrestricted access to historical sessions.

### Attack Path

1. An actor invokes the skill with a keyword associated with sensitive historical information.
2. The wrapper searches locally stored OpenClaw transcripts for matching records.
3. The actor uses `--open` to obtain exact file and line references.
4. Sensitive content from another session or context is read into the current interaction.
5. The information may subsequently be disclosed, copied, or used for further reconnaissance.

### Impact Assessment

Exploitation may expose any session-history content readable by the account executing the wrapper, including historical messages, tool calls, channel metadata, operational errors, and secrets accidentally recorded in transcripts. The scope is limited by the filesystem permissions and filtering behavior of the external `ocgrep` executable, who
...[truncated 58 chars]
Remediation
View remediation

Remediation Suggestions

  • Require explicit user authorization before searching historical conversations.
  • Restrict searches to sessions owned by or expressly shared with the requesting principal.
  • Enforce an allowlisted transcript root inside the wrapper rather than relying only on skill instructions.
  • Disable unrestricted file opening or require confirmation before returning exact file and line contents.
  • Redact credentials, tokens, private keys, and other sensitive values from search output.
  • Record an audit log containing the requesting identity, search scope, query, and accessed sessions.
  • Run the search utility under a dedicated least-privileged account with access only to approved transcript data.

T05 · Unauthorized Access and Privilege Escalation

Warning
Location
SKILL.md:45
Finding

Search Path Can Extend Beyond Intended Transcript Files

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 45-47
Vulnerability Type: Insufficient search-scope enforcement
Risk Level: Medium

Code Snippet:

markdown
## Important caveat

The upstream CLI can search broadly enough to include non-transcript files if you aim it at overly broad paths. Use it for session/transcript discovery first, not repo-wide code search. If results look noisy, tighten with `--path`, `--session`, `--channel`, `--last`, or `--tool-only`.

Technical Analysis

The documentation acknowledges that the upstream CLI can search non-transcript files when supplied with an overly broad path. The instruction to narrow searches is advisory and does not constitute an enforced security boundary.

If the wrapper accepts arbitrary paths, an actor may direct it at unrelated directories readable by the executing account. Keyword searches could then identify sensitive content in source code, configuration files, logs, environment files, or other local data outside the stated transcript-discovery purpose.

The external CLI and wrapper are not part of the audited artifact, so path validation, canonicalization, and filesystem restrictions could not be verified. This finding is therefore based on the explicitly documented ability to search beyond transcript files.

Attack Path

  1. An actor invokes the CLI with --path set to an overly broad or unintended filesystem location.
  2. The tool traverses files outside the approved transcript directories.
  3. The actor searches for high-value terms such as token names, authorization headers, passwords, or private-key markers.
  4. Matching file paths and lines are returned by the tool.
  5. The actor uses the disclosed information for unauthorized reconnaissance or access.

Impact Assessment

The actor may read matching content from non-transcript files accessible to the tool's operating-system account. Potential exposure includes application ...[truncated 264 chars]

Remediation
View remediation

Remediation Suggestions

  • Enforce an immutable allowlist of approved transcript directories in the wrapper.
  • Canonicalize requested paths and reject path traversal, symbolic-link escapes, and paths outside the allowlisted roots.
  • Remove arbitrary --path support unless it is necessary for the intended task.
  • Restrict file types and validate that candidate files match the expected transcript format.
  • Execute the utility in a filesystem sandbox with unrelated repositories, configuration, credentials, and system paths unavailable.
  • Apply output redaction to prevent disclosure of secrets encountered in approved files.
  • Treat documentation warnings as supplemental guidance rather than a replacement for technical access controls.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep