Session Recall

• Outcome: Review
• Latest audit: Sep 16, 2026 · 4:45 AM UTC
• Version: 1.0.0

Overview

This skill is meant to recover lost chat context, but it can search broadly through old and cross-channel conversation logs that may contain private data before asking the user.

Install only in a single-user environment where you are comfortable letting the agent search old, archived, and cross-channel OpenClaw transcripts. Prefer adding a consent step before cross-channel or memory searches, limiting default lookup to the current session, and changing grep usage to fixed-string matching with an option terminator.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (2)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/search_sessions.sh:14

Finding

Unrestricted Cross-Session Search Exposes Sensitive Conversation Data

Content

View full analysis

Vulnerability Details

File Location: scripts/search_sessions.sh:14, 41-49, 94-103; related instructions in SKILL.md:23-57
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: Medium

Vulnerable code:

bash

SESSIONS_DIR="${OPENCLAW_SESSIONS_DIR:-${HOME}/.openclaw/agents/main/sessions}"

bash

# Count total matches (using find to avoid glob expansion issues)
TOTAL=$(find "$SESSIONS_DIR" -maxdepth 1 -name '*.jsonl' -exec grep -l "$KEYWORD" {} + 2>/dev/null | wc -l)
ARCHIVED=$(find "$SESSIONS_DIR" -maxdepth 1 -name '*.reset.*' -exec grep -l "$KEYWORD" {} + 2>/dev/null | wc -l)
echo "Found in $TOTAL active session(s), $ARCHIVED archived session(s)"
echo ""

# Search active .jsonl files (current sessions)
find "$SESSIONS_DIR" -maxdepth 1 -name '*.jsonl' -exec grep -l "$KEYWORD" {} + 2>/dev/null | while read -r f; do

bash

# Report archived matches
if [ "$ARCHIVED" -gt 0 ]; then
  echo "=== Archived sessions with matches ==="
  find "$SESSIONS_DIR" -maxdepth 1 -name '*.reset.*' -exec grep -l "$KEYWORD" {} + 2>/dev/null | head -5 | while read -r f; do
    echo "  $(basename "$f")"
  done
  echo "  (use 'grep' directly on these files for details)"
fi

The associated skill instructions explicitly expand recovery to private data sources:

markdown

### Step 1: Same-channel transcript
Read the `.jsonl` transcript for the current session:
1. Look up the session associated with this channel via `sessions_list` or `sessions.json`
2. Read `~/.openclaw/agents/{agent}/sessions/{sessionId}.jsonl` (default agent: `main`)
3. For large files, read the **tail** first (`tail -n 200`) rather than loading the entire file
4. Check for `.reset` files with the same sessionId prefix (pre-compaction data)
5. If the message is a thread reply, read the parent message first

### Step 3: Cross-channel and cron search
Messages often originate from cron 
...[truncated 2066 chars]

Remediation

View remediation

Remediation Suggestions

• Restrict searches to the current authorized session by default.
• Require explicit user confirmation before accessing archived sessions, other channels, cron sessions, or shared memory.
• Enforce authorization by user identity, channel, agent, and tenant before opening a transcript.
• Maintain an allowlist of permitted transcript paths instead of scanning an entire configurable directory.
• Redact credentials, tokens, passwords, and personal data before emitting excerpts.
• Return only the minimum context necessary and avoid printing raw transcript content to standard output.
• Add audit logging that records file access without recording sensitive matched content.
• Document and enforce a retention policy for archived transcript and reset files.

T09 · Insecure Skill Coding Practices

Note

• Location: scripts/search_sessions.sh:12

Finding

User-Controlled Keyword Is Interpreted as grep Options and Regular-Expression Syntax

Content

View full analysis

Vulnerability Details

File Location: scripts/search_sessions.sh:12, 41-42, 49, 99
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: Low

Vulnerable code:

bash

KEYWORD="$1"

bash

TOTAL=$(find "$SESSIONS_DIR" -maxdepth 1 -name '*.jsonl' -exec grep -l "$KEYWORD" {} + 2>/dev/null | wc -l)
ARCHIVED=$(find "$SESSIONS_DIR" -maxdepth 1 -name '*.reset.*' -exec grep -l "$KEYWORD" {} + 2>/dev/null | wc -l)

bash

find "$SESSIONS_DIR" -maxdepth 1 -name '*.jsonl' -exec grep -l "$KEYWORD" {} + 2>/dev/null | while read -r f; do

bash

find "$SESSIONS_DIR" -maxdepth 1 -name '*.reset.*' -exec grep -l "$KEYWORD" {} + 2>/dev/null | head -5 | while read -r f; do

Technical Analysis

Quoting "$KEYWORD" prevents shell word splitting and shell command substitution, but it does not force grep to treat the value as literal data. A keyword beginning with - may be parsed as a grep option because no -- option terminator is supplied. Regular-expression metacharacters are also interpreted rather than searched literally because fixed-string mode is not enabled.

This behavior is inconsistent with the Python filtering stage, which uses literal substring comparisons. A crafted value can therefore change which files are selected by grep, trigger expensive regular-expression processing, or cause errors and misleading counts. Since the script uses set -euo pipefail, malformed or unsupported options can also terminate the entire recovery operation.

Attack Path

1. An attacker supplies an ambiguous message whose extracted search keyword begins with a grep option or contains a costly regular expression.
2. The skill invokes search_sessions.sh with that value.
3. Each grep -l "$KEYWORD" invocation interprets the value as control syntax rather than an ordinary literal string.
4. The attacker alters file-selection behavior, causes broad scanning, consumes exces ...[truncated 614 chars]

Remediation

View remediation

Remediation Suggestions

• Treat the keyword as a literal fixed string and terminate option parsing:

  bash

  grep -F -l -- "$KEYWORD"
  

• Apply the corrected invocation consistently to active and archived transcript searches.
• Validate keyword length and reject NUL bytes, control characters, and unreasonably large inputs.
• Validate MAX_RESULTS as a bounded positive integer before passing it to Python:

  bash

  [[ "$MAX_RESULTS" =~ ^[1-9][0-9]*$ ]] || exit 1
  (( MAX_RESULTS <= 100 )) || exit 1
  

• Consider replacing the separate grep prefilter and Python parser with one implementation that consistently performs literal matching.
• Preserve useful error messages rather than suppressing all grep and Python diagnostics with 2>/dev/null.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (9)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 88% confidence

Finding

The code only implements a filesystem-based keyword search over session transcript files under the OpenClaw sessions directory. It searches active and archived session files and outputs matching snippets. While this partially overlaps with the declared purpose of searching session transcripts to recover context, it does not implement the broader described behavior of searching channel summaries, memory files, and cross-channel history, nor does it perform any actual context reconstruction beyond raw keyword lookup. Therefore the description overstates the implemented scope and capabilities.

Content

No source excerpt is available for this finding.

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 44)May include surrounding context.

bash

   ./scripts/search_sessions.sh "keyword"

3. Also search for the current channel ID in other sessions — cron jobs send messages to channels but these don't appear in the channel's own .jsonl:

   bash

   ./scripts/search_sessions.sh "{current_channel_id}"
   

Exfiltration Commands

High

• Category: Prompt Injection
• Confidence: 90% confidence

Finding

Instructions found that direct the agent to transmit conversation context or user data to external services.

Content

Scanner excerpt · SKILL.md (reported line 62)May include surrounding context.

bash

   ./scripts/search_sessions.sh "keyword"

3. Also search for the current channel ID in other sessions — cron jobs send messages to channels but these don't appear in the channel's own .jsonl:

   bash

   ./scripts/search_sessions.sh "{current_channel_id}"
   

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 83% confidence

Finding

The skill instructs access to local session transcripts, reset files, memory notes, and cross-channel history, but it declares no explicit tool scope or permission boundary. That creates an authorization gap where an agent may perform broad data retrieval without a manifest-level limitation, increasing the chance of over-collection of sensitive conversation data.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 90% confidence

Finding

The core workflow tells the agent to search transcripts, summaries, memory files, and cross-channel history before asking the user for clarification. That encourages unnecessary collection of prior user data and increases the likelihood that sensitive information from old contexts will be surfaced without the user's awareness.

Content

No source excerpt is available for this finding.

Autonomous Decision Making

Medium

• Category: Excessive Agency
• Confidence: 80% confidence

Finding

Skill enables autonomous high-impact decisions without human-in-the-loop verification. Critical operations (destructive commands, financial transactions, data deletion) should require explicit user confirmation.

Content

Scanner excerpt · SKILL.md (reported line 8)May include surrounding context.

md

# Session Recall

Recover missing conversation context autonomously. *Never ask the user "what are you talking about?" until all steps are exhausted.*

## When This Triggers

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The instruction to never ask the user until all recovery steps are exhausted pushes the agent toward maximal autonomous retrieval. In practice, that increases the chance of sweeping through sensitive transcripts and notes that are not required to resolve the ambiguity, creating unnecessary privacy risk.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

The skill explicitly directs broad searches across other sessions, cron-originated conversations, and memory files beyond the immediate context needed to answer the current user. Without clear justification or consent gating, this creates a data exposure workflow where unrelated historical content may be retrieved and influence the response.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

These instructions authorize searching all session files and other channels using keywords and channel IDs, specifically to discover messages logged outside the current conversation. That broadens access from contextual assistance into cross-session surveillance, which can expose sensitive data from unrelated discussions or cron workflows.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.