Chat Lift

ReviewAudited by ClawScan on May 10, 2026.

Overview

Chat Lift appears to be a local/offline chat archiver, but it trusts conversation IDs from imported data when creating HTML files, which could be unsafe with crafted or corrupted exports.

Install only if you are comfortable processing your chat exports locally. Use trusted exports, run the tool in a separate working folder, and keep the generated archive private. Be especially cautious with exports or archive JSON from someone else until the filename/path sanitization issue is fixed.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If a user processes a crafted or corrupted archive/export, it could cause generated .html files to be written outside chat-archive/web within the user's filesystem permissions, or create unsafe local HTML links.

Why it was flagged

Conversation data is loaded from JSON and the id field is reused directly in generated links and output filenames, without evidence of sanitizing path separators, absolute paths, or resolving the result under the intended output directory.

Skill content

conv = json.load(f); self.conversations.append(conv) ... <a href="{conv['id']}.html"> ... safe_id = conv['id']; with open(self.output_dir / f'{safe_id}.html', 'w', encoding='utf-8') as f:

Recommendation

Use only trusted provider exports and run the tool in a dedicated folder. The code should slugify IDs, reject absolute paths, '..', and path separators, escape IDs in HTML attributes, and verify resolved output paths stay inside the archive directory.

Low

#ASI06: Memory and Context Poisoning

What this means

Private or sensitive chat history may become readable to anyone or anything with access to the output folder, especially if the folder is synced, backed up, hosted, or shared.

Why it was flagged

The skill intentionally copies full AI conversation exports into persistent local Markdown, HTML, and JSON archives for later search and browsing.

Skill content

Generates:
- `chat-archive/markdown/*.md` - Human-readable markdown
- `chat-archive/html/*.html` - Styled HTML pages
- `chat-archive/json/*.json` - Structured JSON

Recommendation

Keep the archive in a private or encrypted location, avoid shared/cloud folders unless intended, and review or remove sensitive conversations before sharing the generated archive.