OpenClaw Session Guard

• Outcome: Review
• Latest audit: May 28, 2026 · 11:17 AM UTC
• Version: 1.0.0

Overview

This skill appears built for OpenClaw session rotation, but it installs background automation that can archive chat excerpts and rewrite active session state without strong user controls.

Install only if you want a background macOS LaunchAgent to manage OpenClaw sessions automatically. Expect recent chat snippets to be stored under ~/.openclaw/knowledge/session-archives and reused for handoff; avoid using it with sessions containing secrets unless you add redaction, cleanup, and stricter file permissions. Verify the missing LaunchAgent plist template and confirm uninstall works before relying on it.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 93% confidence
• Finding: The skill instructs the user/agent to run install, status, and uninstall shell scripts and describes behavior that reads and writes local state such as archives, session rotation data, and scheduled tasks, yet no explicit permissions are declared. This creates a trust and consent gap: the skill can perform file system operations with operational impact without transparent permission signaling, which is especially relevant because it manages persistent session data and task installation.

Missing User Warnings

Medium

• Confidence: 87% confidence
• Finding: The document describes automatic archival, handoff-file creation, and transparent session switching, but it does not clearly warn users that their session state will be modified and new files will be written to disk. In a session-management skill, silent persistence and mutation of active conversation state can surprise users, expose sensitive prompts or summaries in local storage, and create integrity/confidentiality risks if users did not explicitly consent.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The installer silently creates files under the user's home directory and immediately registers and starts a LaunchAgent, establishing persistent background execution without any explicit confirmation or warning. In an agent-skill context, persistence is especially sensitive because users may run install scripts expecting a one-time setup, not an always-on scheduled task.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The script persistently archives recent user and assistant message content to markdown files under ~/.openclaw/knowledge/session-archives without any consent, notice, retention control, or permission hardening. Because these archives contain conversation excerpts and file paths, they expand the exposure surface for sensitive data well beyond the live session and can be read later by other local processes or users with filesystem access.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The rotator extracts recent user and assistant text from the prior session, writes it to archive files, and then instructs the next session to continue from that archive. This creates a deliberate cross-session data flow that can leak secrets, personal data, or prior instructions into new contexts, especially if sessions differ in trust level, audience, or agent behavior.

Session Persistence

Medium

• Category: Rogue Agent

Content

install -m 755 "$SCRIPT_DIR/openclaw-session-rotator.sh" "$BIN_DIR/openclaw-session-rotator.sh"

PLIST_TEMPLATE="$SCRIPT_DIR/ai.openclaw.session.rotator.plist.template"
PLIST_TARGET="$LAUNCH_DIR/ai.openclaw.session.rotator.plist"

python3 - "$PLIST_TEMPLATE" "$PLIST_TARGET" "$HOME_DIR" "$OPENCLAW_BIN" "$OPENCLAW_BIN_DIR" <<'PY'

• Confidence: 90% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

install -m 755 "$SCRIPT_DIR/openclaw-session-rotator.sh" "$BIN_DIR/openclaw-session-rotator.sh"

PLIST_TEMPLATE="$SCRIPT_DIR/ai.openclaw.session.rotator.plist.template"
PLIST_TARGET="$LAUNCH_DIR/ai.openclaw.session.rotator.plist"

python3 - "$PLIST_TEMPLATE" "$PLIST_TARGET" "$HOME_DIR" "$OPENCLAW_BIN" "$OPENCLAW_BIN_DIR" <<'PY'

• Confidence: 90% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

install -m 755 "$SCRIPT_DIR/openclaw-session-rotator.sh" "$BIN_DIR/openclaw-session-rotator.sh"

PLIST_TEMPLATE="$SCRIPT_DIR/ai.openclaw.session.rotator.plist.template"
PLIST_TARGET="$LAUNCH_DIR/ai.openclaw.session.rotator.plist"

python3 - "$PLIST_TEMPLATE" "$PLIST_TARGET" "$HOME_DIR" "$OPENCLAW_BIN" "$OPENCLAW_BIN_DIR" <<'PY'
import pathlib, sys

• Confidence: 90% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

install -m 755 "$SCRIPT_DIR/openclaw-session-rotator.sh" "$BIN_DIR/openclaw-session-rotator.sh"

PLIST_TEMPLATE="$SCRIPT_DIR/ai.openclaw.session.rotator.plist.template"
PLIST_TARGET="$LAUNCH_DIR/ai.openclaw.session.rotator.plist"

python3 - "$PLIST_TEMPLATE" "$PLIST_TARGET" "$HOME_DIR" "$OPENCLAW_BIN" "$OPENCLAW_BIN_DIR" <<'PY'
import pathlib, sys

• Confidence: 90% confidence
• Finding: plist

Session Persistence

Medium

• Category: Rogue Agent

Content

PLIST_TEMPLATE="$SCRIPT_DIR/ai.openclaw.session.rotator.plist.template"
PLIST_TARGET="$LAUNCH_DIR/ai.openclaw.session.rotator.plist"

python3 - "$PLIST_TEMPLATE" "$PLIST_TARGET" "$HOME_DIR" "$OPENCLAW_BIN" "$OPENCLAW_BIN_DIR" <<'PY'
import pathlib, sys
tpl, out, home, oc_bin, oc_bin_dir = map(pathlib.Path, sys.argv[1:6])
text = tpl.read_text(encoding="utf-8")

• Confidence: 88% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

PLIST_TEMPLATE="$SCRIPT_DIR/ai.openclaw.session.rotator.plist.template"
PLIST_TARGET="$LAUNCH_DIR/ai.openclaw.session.rotator.plist"

python3 - "$PLIST_TEMPLATE" "$PLIST_TARGET" "$HOME_DIR" "$OPENCLAW_BIN" "$OPENCLAW_BIN_DIR" <<'PY'
import pathlib, sys
tpl, out, home, oc_bin, oc_bin_dir = map(pathlib.Path, sys.argv[1:6])
text = tpl.read_text(encoding="utf-8")

• Confidence: 88% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

out.write_text(text, encoding="utf-8")
PY

launchctl bootout "gui/$(id -u)" "$PLIST_TARGET" >/dev/null 2>&1 || true
launchctl bootstrap "gui/$(id -u)" "$PLIST_TARGET"
launchctl kickstart -k "gui/$(id -u)/ai.openclaw.session.rotator"

• Confidence: 95% confidence
• Finding: PLIST

Session Persistence

Medium

• Category: Rogue Agent

Content

PY

launchctl bootout "gui/$(id -u)" "$PLIST_TARGET" >/dev/null 2>&1 || true
launchctl bootstrap "gui/$(id -u)" "$PLIST_TARGET"
launchctl kickstart -k "gui/$(id -u)/ai.openclaw.session.rotator"

echo "[install] done"

• Confidence: 95% confidence
• Finding: PLIST

VirusTotal

65/65 vendors flagged this skill as clean.

Static analysis

No suspicious patterns detected.