Sayba Session Cleanup

• Outcome: Pass
• Latest audit: Sep 16, 2026 · 7:33 AM UTC
• Version: 1.0.0

Overview

This skill does what it says: removes OpenClaw subagent session entries from the local sidebar index, with some data-loss precautions users should apply.

Before installing or using it, run --dry-run first and consider backing up ~/.openclaw/agents before cleanup. Use --agent when you only want one agent cleaned, and only use --all when you intentionally want every subagent entry removed from the sidebar index.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/cleanup_sessions.py:58

Finding

Non-Atomic Overwrite Can Corrupt the Session Index

Content

View full analysis

Vulnerability Details

File Location: scripts/cleanup_sessions.py, lines 58–59
Vulnerability Type: Non-atomic modification of a critical state file
Risk Level: Medium

Vulnerable Code

python

with open(sessions_file, "w") as f:
    json.dump(data, f, indent=2)

Technical Analysis

The script opens the active sessions.json file in write mode, which truncates the file before the updated JSON has been fully serialized and persisted. If the process is interrupted or the write fails because of an I/O error, exhausted disk space, or another exceptional condition, the live session index can be left empty or partially written.

The implementation does not write through a temporary file, atomically replace the original, synchronize the completed write to disk, retain a backup, or provide a recovery path. This is an insecure coding practice when modifying a state file required by another application component.

Attack Path

1. A user invokes the session cleanup script against an OpenClaw agent.
2. The script loads the existing session index and determines which entries to remove.
3. It opens the live sessions.json with mode "w", immediately truncating the file.
4. The process is terminated or the write fails before json.dump completes.
5. OpenClaw subsequently reads an empty, truncated, or malformed session index.
6. Valid sessions may disappear from the interface, or session-state loading may fail until the index is restored.

This path primarily represents an availability and integrity failure. Exploitation would require the ability to interfere with the cleanup process or its storage environment; it does not grant additional operating-system privileges.

Impact Assessment

The issue affects the integrity and availability of the targeted OpenClaw agent's session index. Corruption may cause valid session records to be lost from the index, make sessions disappear from the webchat interface, or prevent the gateway from loadin ...[truncated 238 chars]

Remediation

View remediation

Remediation Suggestions

Write the modified JSON to a uniquely named temporary file in the same directory as sessions.json, then atomically replace the original only after the complete output has been successfully persisted.

Recommended hardening steps:

1. Create the temporary file securely in the destination directory, such as with tempfile.NamedTemporaryFile.
2. Preserve the original file's ownership and permission mode where applicable.
3. Serialize the complete JSON document to the temporary file.
4. Flush Python's buffers and call os.fsync() on the temporary file descriptor.
5. Optionally reopen and parse the temporary file to validate that it contains valid JSON.
6. Replace the live index with os.replace(), which is atomic when source and destination are on the same filesystem.
7. Synchronize the parent directory where durability guarantees are required.
8. Retain a backup of the previous index or provide a restoration mechanism.
9. Catch and report filesystem and serialization exceptions without modifying the original file.
10. Consider file locking or coordination with the gateway to avoid concurrent updates and lost writes.

Example pattern:

python

import os
import tempfile

parent = sessions_file.parent
mode = sessions_file.stat().st_mode

temp_path = None
try:
    with tempfile.NamedTemporaryFile(
        mode="w",
        dir=parent,
        prefix=f".{sessions_file.name}.",
        suffix=".tmp",
        delete=False,
    ) as tmp:
        temp_path = Path(tmp.name)
        json.dump(data, tmp, indent=2)
        tmp.flush()
        os.fsync(tmp.fileno())

    os.chmod(temp_path, mode)
    os.replace(temp_path, sessions_file)
except Exception:
    if temp_path is not None:
        temp_path.unlink(missing_ok=True)
    raise

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (2)

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 88% confidence

Finding

The skill describes file-modifying behavior against sessions.json but does not declare any tool scope or permission boundary. That creates an authorization gap: an agent invoking this skill may gain undeclared write capability, making destructive file changes less visible to reviewers and increasing the chance of misuse or overreach.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The --all mode removes every subagent session entry, but the skill does not present a prominent warning or require explicit confirmation for this destructive action. In context, this can cause unintended loss of session visibility/history in the UI and may delete references broadly if triggered by an ambiguous user request or agent mistake.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.