Session Cleanup

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:35 AM UTC
• Version: 1.0.0

Overview

This cleanup skill can automatically and permanently delete OpenClaw session, queue, Telegram, subagent, memory, and backup files without the promised value checks or dry-run safeguards.

Review carefully before installing. Only use this if you explicitly want unattended deletion of old OpenClaw files, and preferably after adding dry-run output, confirmation or quarantine, status/value checks, safer logging, and a scoped non-root workspace.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T09 · Insecure Skill Coding Practices

Warning

• Location: cleanup.sh:4

Finding

Predictable Temporary Log Path Allows Symlink-Based File Modification

Content

View full analysis

Vulnerability Details

File Location: cleanup.sh, lines 4-8
Vulnerability Type: Unsafe temporary file handling and symbolic-link following
Risk Level: Medium

Vulnerable Code

bash

LOG_FILE="/tmp/session-cleanup-$(date +%Y%m%d).log"

log() {
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" | tee -a "$LOG_FILE"
}

Technical Analysis

The script constructs a predictable daily log filename in the shared /tmp directory and opens it through tee -a. It does not securely create the file, verify its ownership, reject symbolic links, or use a private directory.

If the script executes with elevated privileges and the operating system permits the privileged process to follow the link, another local user can create the expected path as a symbolic link to a file writable by the script's effective user. Each call to log then causes tee to follow that link and append script-controlled log text to the target.

Exploitability can be reduced by operating-system symbolic-link protections, but the script itself does not enforce any protection and therefore must not rely on environment-specific hardening.

Attack Path

1. A local attacker predicts the daily path, such as /tmp/session-cleanup-20260911.log.
2. Before the scheduled cleanup runs, the attacker creates that path as a symbolic link to a selected target file.
3. The cleanup script runs with an account, potentially root, that can write to the target.
4. tee -a opens the symbolic-link target and appends cleanup log entries.
5. The target file is modified or corrupted. The practical result depends on the target format and the content appended by the script.

Impact Assessment

This flaw can allow a local attacker to redirect privileged append operations to another file. If the cleanup job runs as root, the affected scope includes files writable by root, potentially causing configuration corruption or denial of service.

The prim ...[truncated 237 chars]

Remediation

View remediation

Remediation Suggestions

• Store logs in a dedicated directory owned by the service account, with permissions such as 0700, rather than directly under /tmp.
• Create the log atomically with mktemp or an equivalent mechanism.
• Set a restrictive file-creation mask, such as umask 077.
• Reject existing symbolic links and verify the resulting file is a regular file owned by the expected account.
• Prefer a managed logging facility such as the system journal when the task runs as a scheduled privileged service.
• If a stable filename is required, securely create and open it without following symbolic links and apply restrictive permissions before writing.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: cleanup.sh:21

Finding

Overbroad Cleanup Deletes Data Without the Documented Status or Value Checks

Content

View full analysis

Vulnerability Details

File Location: cleanup.sh, lines 21-53
Vulnerability Type: Unrestricted destructive file cleanup
Risk Level: High

Vulnerable Code

bash

find "$WORKSPACE/delivery-queue" -name "*.json" -mtime +1 -type f 2>/dev/null | while read f; do
    rm -f "$f"
done

if [ -d "$WORKSPACE/telegram" ]; then
    find "$WORKSPACE/telegram" -type f -mtime +7 2>/dev/null | while read f; do
        rm -f "$f"
    done
fi

if [ -d "$WORKSPACE/subagents" ]; then
    find "$WORKSPACE/subagents" -type f -mtime +7 2>/dev/null | while read f; do
        rm -f "$f"
    done
fi

find "$WORKSPACE" -name "*.bak*" -mtime +3 -type f 2>/dev/null | while read f; do
    rm -f "$f"
done

find "$WORKSPACE/memory" -name "*.tmp-*" -type f 2>/dev/null | while read f; do
    rm -f "$f"
done

Technical Analysis

The skill documentation states that expired sessions are evaluated for value, valuable information is preserved, and delivery-queue cleanup is limited to completed or failed entries. The implementation does not parse queue status, inspect session contents, perform keyword-based value assessment, or preserve valuable sessions.

Instead, it permanently deletes:

• Every matching delivery-queue JSON file older than one day, regardless of status.
• Every Telegram and subagent file older than seven days, regardless of content or importance.
• Every file matching *.bak* older than three days anywhere under the hard-coded workspace.
• Every memory file matching *.tmp-*, with no age requirement.

The workspace is fixed as /root/.openclaw, so scheduled execution is likely to operate on privileged application data. The broad recursive backup search also removes recovery material outside the session directories specifically described by the skill.

Attack Path

1. Important, active, or otherwise valuable data exists in one of the searched directories.
2. The data either rea ...[truncated 1349 chars]

Remediation

View remediation

Remediation Suggestions

• Parse each delivery-queue record and delete it only after explicitly confirming a terminal status such as completed or failed.
• Implement the documented session-value assessment before deletion and preserve qualifying data in a controlled memory or archival location.
• Limit cleanup to canonical, explicitly approved directories and file types instead of recursively deleting *.bak* throughout the workspace.
• Add a suitable minimum-age requirement for memory/*.tmp-* files.
• Move candidates into a restricted quarantine directory first and delete them only after a configurable retention period.
• Add a dry-run mode that reports every candidate and the reason it was selected.
• Record stable file identifiers and revalidate type, location, status, and modification time immediately before deletion.
• Run the cleanup under a dedicated least-privileged account with access only to data that it is authorized to remove.
• Create recoverable backups outside the cleanup search scope and test restoration procedures.
• Align the documentation and implementation so that users can accurately understand the deletion policy.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (6)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

The skill metadata and workflow promise value-based assessment and preservation of important sessions, but the documented behavior is centered on automated deletion across multiple user data directories. This mismatch is dangerous because operators may authorize or schedule the skill based on a benign description while it performs destructive cleanup, increasing the risk of unintended data loss in sensitive session stores such as Telegram and subagent data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The skill describes cleanup and removal behavior but does not prominently warn that files and session data may be permanently deleted. In a maintenance skill targeting real user/state directories, lack of explicit deletion warnings can cause accidental execution, unsafe trust by users, and irreversible loss of operational or personal data.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

Documenting unattended cron-based execution for a destructive cleanup task without warning about autonomous deletion materially increases risk. Scheduled runs can remove data from active system and user-state directories without contemporaneous review, making mistakes in retention logic or path selection much more damaging and harder to notice.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 84% confidence

Finding

The script's title, status messages, and deletion logs are written in Chinese, making the operational interface effectively fixed to a specific language. The file does not offer user opt-in, fallback language selection, or any documented justification that this is a region-specific or Chinese-only tool.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The manifest says the skill should periodically clean expired sessions, assess and save valuable information, and automatically clean valueless sessions. In code, every action is unconditional deletion based on file age or filename pattern, followed only by summary counts; there is no logic to evaluate session value or preserve useful information before cleanup.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The manifest description is entirely in Chinese, which imposes a specific language on users without indicating any choice, opt-in, or region-specific justification. This can violate language/locale policy requirements for skills intended for general use.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.