T09 · Insecure Skill Coding Practices
- Location
SKILL.md:70- Finding
Destructive Session Recovery Deletes All Agent Session Data Without Backup or Confirmation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 70-77
Vulnerability Type: Destructive administrative recovery procedure
Risk Level: MediumVulnerable Code
bash systemctl stop openclaw-gateway rm -rf /root/.openclaw/.openclaw/agents/main/sessions/* echo '{}' > /root/.openclaw/.openclaw/agents/main/sessions/sessions.json chmod 600 /root/.openclaw/.openclaw/agents/main/sessions/sessions.json systemctl start openclaw-gatewayTechnical Analysis
The recovery playbook responds to a repeated
orphaned user messagecondition by recursively deleting every entry in the main agent's session directory and replacing the session index with an empty JSON object. The procedure does not:- Back up session files before deletion.
- Request explicit operator confirmation.
- Identify and remove only the corrupted session.
- Validate the target path before invoking
rm -rf. - Provide a rollback or restoration process.
The command is expected to run with sufficient privileges to manage system services and modify files under
/root. Although the path is static and does not present a demonstrated command-injection vector, the documented response is substantially broader than necessary for repairing an individual orphaned session. It also conflicts with the skill's own guardrail requiring backups before major edits.Attack Path
- A repeated
orphaned user messageentry appears in the gateway logs, whether due to ordinary corruption or an externally induced malformed interaction. - An operator or privileged agent follows the recovery playbook.
- The gateway is stopped, interrupting service.
rm -rfremoves all files and directories beneath the main agent's session directory, not merely the affected session.- The session index is overwritten with an empty object.
- The gateway restarts without the deleted session state.
- In the absence of a separate backup, the prior state ...[truncated 720 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit operator confirmation before deleting or resetting session state.
- Stop the gateway and create a timestamped backup with restrictive permissions before making changes:
bash session_dir=/root/.openclaw/.openclaw/agents/main/sessions backup_dir="/root/.openclaw/backups/sessions-$(date +%Y%m%dT%H%M%S)" install -d -m 700 "$backup_dir" cp -a -- "$session_dir/." "$backup_dir/" - Diagnose the affected session identifier from validated logs and quarantine only that session rather than deleting the entire directory.
- Canonicalize and verify the target directory before any destructive operation. Refuse to proceed if it is empty, missing, a symbolic link, or differs from the expected path.
- Prefer reversible quarantine using
mvover permanent deletion. - Validate the reconstructed session index before restarting the gateway, preserving unaffected entries where possible.
- Document and test a rollback process that restores the backup and its ownership and permissions.
- If a full reset is genuinely necessary, present it as a last-resort operation with a clear data-loss warning rather than the default response to the log pattern.