Session Handoff

• Analyzed: May 12, 2026, 3:46 AM
• Findings: 1
• Version: 0.1.0
• Hash: 5dae68f3ac638f631213233455c0ae0133c49ce1d0ec6ca108046bc0f69489a2
• Source: palm
• External report: View on VirusTotal

Findings (1)

The OpenClaw AgentSkills skill bundle is designed for legitimate context management and handoff creation. However, the `scripts/validate_handoff.py` script contains a path traversal vulnerability. Specifically, the `check_file_references` function, when parsing file paths from a handoff document, does not adequately sanitize paths, allowing `../` sequences. This could enable a malicious handoff document to check for the existence of arbitrary files outside the project directory (e.g., `/etc/passwd`) on the agent's system, leading to an information disclosure vulnerability.