Security audit

📜 对话日志检索

Security checks for vulnerabilities and agentic risk

Overview

The skill has a legitimate purpose, but it tells agents to search broad local conversation logs without clear authorization, privacy, or redaction limits.

Install only if you are comfortable giving the agent direct read access to local conversation transcripts. Use it with narrow dates, keywords, or known session IDs, and avoid asking it to search broadly across all sessions unless you have verified the requester is authorized to see those logs.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally

Findings (1)

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: SKILL.md:9
Finding: Unrestricted Cross-Session Access to Sensitive Conversation Logs
Content: View full analysis
/sessions/` (use the `agent=` value from the system prompt Runtime line). - **`sessions.json`** - Index mapping session keys to session IDs - **`.jsonl`** - Full conversation transcript per session ## Structure Each `.jsonl` file contains messages with: - `type`: "session" (metadata) or "message" - `timestamp`: ISO timestamp - `message.role`: "user", "assistant", or "toolResult" - `message.content[]`: Text, thinking, or tool calls (filter `type=="text"` for human-readable content) - `message.usage.cost.total`: Cost per response ``` ```markdown ### Search across ALL sessions for a phrase ```bash rg -l "phrase" ~/.clawdbot/agents//sessions/*.jsonl ``` ``` ```markdown ## Fast text-only hint (low noise) ```bash jq -r 'select(.type=="message") | .message.content[]? | select(.type=="text") | .text' ~/.clawdbot/agents//sessions/.jsonl | rg 'keyword' ``` ``` ### Technical Analysis The skill directs the agent to locate and inspect complete conversation transcripts stored under the agent-wide session directory. These records can include user and assistant messages, tool results, tool calls, internal thinking content, usage information, and sessions associated with different chat providers. The documented trigger only requires a user to ask about prior conversations. It does not require the requester to identify an authorized session, prove ownership of the requested transcript, or limit the search to sessions belonging to the same user or tenant. The command under “Search across ALL sessions” explicitly searche ...[truncated 2410 chars]
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (1)

Missing User Warnings

Medium

Category: Not specified by scanner
Confidence: 97% confidence
Finding: The skill explicitly instructs the agent to search complete session history and historical transcripts without any privacy warning, consent check, or minimization guidance. Because session logs can contain sensitive user data, secrets, or content from other contexts, this increases the risk of over-collection and unintended disclosure when responding to a user request about prior conversations.
Content: No source excerpt is available for this finding.