Security audit

Openclaw Skill Session Memory

Security checks across malware telemetry and agentic risk

Overview

This skill transparently provides local session memory by saving and searching OpenClaw conversations, with privacy caveats but no evidence of hidden exfiltration or destructive behavior.

Install only if you want OpenClaw conversations saved as searchable local markdown files. Do not treat the redaction as a guarantee that all secrets or personal data are removed; periodically review or delete the memory files if sessions may contain private, regulated, or business-sensitive information.

SkillSpector

By NVIDIA

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (6)

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The README states that the skill will automatically record conversation content and store it by date, but it does not prominently warn users that chat data is persisted to disk by default or explain the privacy/security implications of that behavior. In a session-memory skill, silent or insufficiently disclosed persistence increases the risk of collecting sensitive user content without informed consent, especially in shared or poorly secured environments.

Missing User Warnings

Medium

Confidence: 92% confidence
Finding: The skill explicitly states that conversation content is automatically saved to persistent markdown files, but it does not provide any user-facing warning, consent flow, retention notice, or scope limitation. Persistently storing chat transcripts increases privacy and data exposure risk, especially because conversations can contain sensitive information that simple regex-based masking may miss.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: Automatic invocation at session end means users may be recorded by default without a clear opportunity to consent or avoid retention. This is dangerous because the skill is designed to capture entire conversations, and the documented redaction rules are incomplete and cannot guarantee removal of all secrets, personal data, or regulated information.

Missing User Warnings

Medium

Confidence: 93% confidence
Finding: The script automatically extracts conversation content from local session logs and persists it to a markdown file, creating a second copy of potentially sensitive user and assistant data. Although it applies some redaction, the rules are incomplete and heuristic-based, so secrets, personal data, or confidential prompts may still be retained without explicit user consent or warning.

Missing User Warnings

Medium

Confidence: 95% confidence
Finding: The `record()` flow extracts conversation messages from session files and persists them to a predictable location under the user's home directory without any consent prompt, retention control, or warning about local storage. Even though the code attempts redaction, the regex-based filtering is incomplete and can miss secrets or sensitive personal data, creating a privacy and data exposure risk if the files are later accessed by other local processes, backups, or users.

Ssd 3

Medium

Confidence: 94% confidence
Finding: The skill's core behavior is to retain and store conversation content for later search, which creates a persistent data repository of potentially sensitive user interactions. Even with partial masking, regex-based desensitization is inherently error-prone, and searchable local archives increase the blast radius if the files are accessed by unauthorized users, malware, or other skills.

VirusTotal

66/66 vendors flagged this skill as clean.

View on VirusTotal

Static analysis

No suspicious patterns detected.