session-fork

• Outcome: Pass
• Latest audit: Sep 19, 2026 · 8:13 AM UTC
• Version: 2.4.18

Overview

The skill locally copies and registers agent-session branches; it touches sensitive local session stores, but that behavior is disclosed, purpose-aligned, and not exfiltrative.

Install only if you want a tool that can read and modify local agent session stores. Use --dry-run first, confirm the Source line names the intended conversation, prefer explicit --session or --request-id over 'current', and keep the automatic backups until you have verified the new branch opens correctly.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally
• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain

Findings (18)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The declared description is about creating independent forks of in-progress work with preserved context. The supplied code does not implement that behavior. Its primary purpose is registry/dispatch infrastructure for adapters: maintaining product specs, checking module presence, reporting available adapters, selecting a backend for OpenClaw, and importing/instantiating adapter classes. Although comments claim real fork logic exists elsewhere (engine.py and adapter modules), those files are not part of the supplied code chunk and should not be assumed for this comparison. Therefore, this chunk materially does not match the declared purpose.

Lp1

High

• Category: MCP Least Privilege
• Confidence: 75% confidence
• Finding: The skill uses 'env' capability that is not listed in its permissions. This may indicate deceptive intent or missing permission declarations.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The trigger conditions are intentionally broad and include common phrases around branching tasks, which can cause the agent to invoke a file-writing/session-modifying workflow when the user may only be discussing options conceptually. In this skill context, unintended invocation matters because the workflow can create new session artifacts and write to local session stores, so ambiguous activation expands the chance of unauthorized or surprising state changes.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

| 家目录 | `~` / `$HOME` | `$env:USERPROFILE`（PS）· `%USERPROFILE%`（CMD） |
| 设环境变量 | `export CODEX_HOME=/x` | PS `$env:CODEX_HOME="C:\x"` · CMD `set CODEX_HOME=C:\x` |
| 查文件内容 | `grep -n "词" f.jsonl` | PS `Select-String -Path f.jsonl -Pattern "词"` · CMD `findstr /n "词" f.jsonl` |
| 设文件只读 | `chmod 444 f` | `attrib +R f` |

**Windows 上的四个坑**（均有官方依据）：

• Confidence: 80% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Tainted flow: 'BRANCH_INDEX' from os.environ.get (line 35, credential/environment) → open (file write)

Medium

• Category: Data Flow

Content

raise RuntimeError(f"分支索引路径异常，已拒写：{_target}（预期 {_expect}）")
        notify(f"更新旁路分支索引 / updating sidecar branch index: {BRANCH_INDEX}", quietable=False)
        os.makedirs(CLAUDE_DIR, exist_ok=True)
        with open(BRANCH_INDEX, "w", encoding="utf-8") as f:
            f.write(dumps_safe(data, indent=2))

    def register_branch(self, src: SessionMeta, new_id: str, dst_path: str, name: str, parent_id: str = None, at_seq: int = None, prefix_fp: str | None = None) -> None:

• Confidence: 65% confidence
• Finding: Data from a source is assigned to a variable that is later passed to a sink, creating a variable-mediated taint flow.

Natural-Language Policy Violations

Medium

• Confidence: 97% confidence
• Finding: The module docstring and comments are entirely in Chinese, and the user-facing strings returned by methods such as activation_hint, produce_hint, backup_note, and readonly_hint are also hard-coded in Chinese. This imposes a specific language on users without any opt-in, fallback, or stated region-specific justification, which matches the locale-policy violation criteria.

Missing User Warnings

Medium

• Confidence: 83% confidence
• Finding: This code modifies the user's OpenClaw state by overwriting `sessions.json` and creating backup copies, which affects how sessions are discovered by the product. While there is an internal docstring about atomic writing, there is no user-facing disclosure such as a prompt, print/log message, or explicit warning in this file that the skill will alter persistent session metadata under the user's state directory.

Natural-Language Policy Violations

Medium

• Confidence: 93% confidence
• Finding: The file’s natural-language documentation, comments, and user-facing hints are entirely in Chinese, and there is no indication that language selection is optional or limited to a China-specific deployment. Under the policy, forcing a specific language or locale without user opt-in is a natural-language policy violation.

Natural-Language Policy Violations

Medium

• Confidence: 94% confidence
• Finding: The module’s natural-language documentation and multiple user-facing status/error strings are written exclusively in Chinese, and there is no indication of user opt-in or language selection. This can violate language/locale policy when users or operators are expected to interact in another language.

Natural-Language Policy Violations

Medium

• Confidence: 91% confidence
• Finding: The file-level comments and docstring present operational and audit guidance entirely in Chinese, including explicit instructions to auditors about how to interpret the file. This creates a locale/language constraint in the skill's natural-language interface without any indication that users can choose another language or that the restriction is justified as region-specific.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: The module docstring and user-facing messaging establish a Chinese-only interface, and later help/error/status strings throughout the CLI are also emitted in Chinese. This is a natural-language policy concern because the skill does not offer any locale selection, fallback, or explicit justification for forcing a specific language.

Natural-Language Policy Violations

Medium

• Confidence: 96% confidence
• Finding: This code file contains natural-language documentation and many user-facing messages primarily in Chinese, including the module header and explanatory docstrings, without indicating any language choice or opt-in. Under the policy, forcing a specific language/locale without user choice is a natural-language policy violation.

Natural-Language Policy Violations

Low

• Confidence: 95% confidence
• Finding: These lines explicitly say the skill is written for Chinese users and present English only as an overview link, which indicates a default language constraint. The file does not offer an explicit language-choice mechanism or user opt-in in the skill behavior itself, so this may violate language/locale policy expectations.

Natural-Language Policy Violations

Low

• Confidence: 90% confidence
• Finding: This line reiterates that the skill is aimed at Chinese users, while only providing English metadata links rather than a user-selectable language option. That is a natural-language locale constraint that is not presented as opt-in or strictly justified as region-specific.

Natural-Language Policy Violations

Low

• Confidence: 84% confidence
• Finding: The comment at L197 says safety-related prompts should not be shown in only one language and prescribes Chinese-English bilingual output. This is a natural-language locale policy choice that appears to be enforced globally, without indicating user choice or opt-in.

Missing User Warnings

Low

• Confidence: 77% confidence
• Finding: The code relies on session identifiers from environment variables, explicitly mentioning CLAUDE_SESSION_ID, CODEBUDDY_SESSION_ID, and BAGGAGE in its error text. This is access to potentially sensitive runtime context, but there is no nearby comment or user-facing notice explaining that the adapter reads these environment-provided identifiers during normal operation.

Dynamic attribute access via getattr()

Low

• Category: Dangerous Code Execution

Content

import importlib

        module = importlib.import_module(f".{module_name}", package=__package__)
        return register(getattr(module, class_name)())
    raise SystemExit(f"Unknown adapter: {name!r} (available: {', '.join(available())})")

• Confidence: 50% confidence
• Finding: Dynamic getattr() with a non-literal attribute name can access arbitrary object attributes, potentially bypassing access controls.

Natural-Language Policy Violations

Low

• Confidence: 89% confidence
• Finding: This code file contains user-facing natural-language text primarily in Chinese, including the title, description, and command examples. The policy allows locale constraints only when the skill offers a language choice or clearly documents a justified regional limitation, which is not present here.

Static analysis

No suspicious patterns detected.