Conversation Guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:08 PM UTC
• Version: 0.1.0

Overview

The skill is a disclosed local conversation backup tool, but it asks agents to automatically persist complete chats and installs executable shell code from a mutable remote URL without integrity checks.

Install only if you intentionally want every agent exchange copied into local plaintext history. Review or replace the install commands so they use the bundled script or a pinned verified release, add redaction for passwords/tokens/private data, restrict file permissions, and define how long conversation backups should be kept.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:23
• Finding: Mutable Remote Shell Script Is Retrieved and Executed Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:23-28` and `SKILL.md:283-288` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash # Download the guard script curl -o ~/.openclaw/workspace/scripts/conversation-guard.sh \ https://raw.githubusercontent.com/zfanmy/dreammoon-conversation-guard/main/conversation-guard.sh # Make executable chmod +x ~/.openclaw/workspace/scripts/conversation-guard.sh ``` The update instructions repeat the same unsafe retrieval pattern: ```bash # Re-download latest version curl -o ~/.openclaw/workspace/scripts/conversation-guard.sh \ https://raw.githubusercontent.com/zfanmy/dreammoon-conversation-guard/main/conversation-guard.sh chmod +x ~/.openclaw/workspace/scripts/conversation-guard.sh ``` The downloaded file is subsequently loaded into the active shell: ```bash source ~/.openclaw/workspace/scripts/conversation-guard.sh ``` ### Technical Analysis The installation and update procedures retrieve executable shell code from the mutable `main` branch of a personal GitHub repository. The instructions do not pin the download to an immutable commit, verify a cryptographic checksum or signature, or inspect the downloaded content before it is sourced. Because `source` executes commands in the current shell rather than an isolated subprocess, a modified remote script can access the invoking process's environment, alter shell state, redefine commands or functions, read files available to the current user, and execute arbitrary commands with that user's privileges. The network download is relevant to installation, but relying on a mutable branch without integrity verification exceeds the minimum trust necessary. The audited bundled script could instead be installed directly, or an immutable, verified release artifact could be used. ### Attack Path 1. An attacker compromises the repository, maintainer account, publishing workflow, or another mechanism ...[truncated 1182 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer the audited `conversation-guard.sh` bundled with the Skill instead of downloading a second copy at installation time. 2. If remote retrieval is required, pin the URL to an immutable commit hash or a versioned release artifact rather than `main`. 3. Publish and verify a SHA-256 digest or cryptographic signature before installation. 4. Use hardened transfer options: ```bash curl --fail --show-error --location --proto '=https' \ -o conversation-guard.sh.tmp \ 'https://raw.githubusercontent.com/.../<immutable-commit>/conversation-guard.sh' ``` 5. Verify the temporary file before replacing the installed script: ```bash printf '%s %s\n' "$EXPECTED_SHA256" conversation-guard.sh.tmp | sha256sum --check - ``` 6. Install the verified file atomically and with an explicit mode: ```bash install -m 0700 conversation-guard.sh.tmp \ "$HOME/.openclaw/workspace/scripts/conversation-guard.sh" ``` 7. Apply the same controls to the update procedure, and never overwrite a trusted executable until verification succeeds. 8. Consider executing the script as a constrained subprocess rather than sourcing it when access to the caller's complete shell environment is unnecessary. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: conversation-guard.sh:70
• Finding: Complete Conversations Are Persisted in Plaintext Without Enforced Private Permissions<![CDATA[ ## Vulnerability Details **File Location**: `conversation-guard.sh:70-111`; automatic recording configured at `SKILL.md:32-58` **Vulnerability Type**: Insecure storage of potentially sensitive conversation data **Risk Level**: Medium ### Vulnerable Code ```bash record_interaction() { local user_msg="$1" local assistant_msg="$2" local importance="${3:-5}" local tags="${4:-normal}" local timestamp=$(date '+%Y-%m-%d %H:%M:%S') # Ensure directories exist if [ -n "$GUARDIAN_DIR" ] && [ -n "$MEMORY_DIR" ]; then mkdir -p "$GUARDIAN_DIR" mkdir -p "$MEMORY_DIR" fi # Escape for JSON local user_json=$(echo "$user_msg" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))' 2>/dev/null || echo "\"$user_msg\"") local assistant_json=$(echo "$assistant_msg" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))' 2>/dev/null || echo "\"$assistant_msg\"") # Write to JSONL backup echo "{\"t\":\"$timestamp\",\"r\":\"user\",\"c\":$user_json,\"i\":$importance,\"g\":\"$tags\"}" >> "$BACKUP_FILE" echo "{\"t\":\"$timestamp\",\"r\":\"assistant\",\"c\":$assistant_json,\"i\":$importance,\"g\":\"$tags\"}" >> "$BACKUP_FILE" # Write to Markdown (human-readable) { echo "**👤 USER** ($timestamp)" echo "" echo "$user_msg" echo "" echo "**🌙 ASSISTANT** ($timestamp)" echo "" echo "$assistant_msg" echo "" # Add emotional marker for high importance if [ "$importance" -ge 8 ]; then echo "<!-- 💝 High importance [$importance] | 高重要性: $tags -->" echo "" fi echo "---" echo "" } >> "$TODAY_FILE" # Emergency log for critical conversations if [ "$importance" -ge 9 ]; then echo "$(date '+%Y%m%d_%H%M%S') [IMPORTANCE:$importance] [$tags]" >> "${GUARDIAN_DIR}/.emergency_log.txt" fi } ``` The recommend ...[truncated 2503 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Set a restrictive process file-creation mask before creating storage: ```bash umask 077 ``` 2. Create private directories and explicitly correct existing permissions: ```bash mkdir -p -m 0700 "$GUARDIAN_DIR" "$MEMORY_DIR" chmod 0700 "$GUARDIAN_DIR" "$MEMORY_DIR" ``` 3. Create or normalize log files with mode `0600` before appending: ```bash touch "$TODAY_FILE" "$BACKUP_FILE" chmod 0600 "$TODAY_FILE" "$BACKUP_FILE" ``` 4. Require informed opt-in before enabling automatic recording in `AGENTS.md`. 5. Add configurable redaction for passwords, access tokens, private keys, authorization headers, and other common secret formats. 6. Allow users to exclude individual messages or disable recording for sensitive sessions. 7. Implement configurable retention limits and secure deletion or archival procedures. 8. Avoid unnecessary duplication of sensitive content. Permit users to select Markdown, JSONL, or encrypted storage instead of enabling multiple plaintext copies by default. 9. Offer authenticated encryption for stored conversations when the threat model includes other local users, shared workspaces, or external backup systems. 10. Document that copying, synchronizing, indexing, or committing the workspace can expose conversation history. ]]>

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Missing User Warnings

High

• Confidence: 98% confidence
• Finding: The skill instructs the agent to automatically record every user message and assistant response to persistent local storage after each exchange, but it provides no explicit consent flow, privacy notice, retention limit, or redaction guidance. This creates a clear risk of silently capturing sensitive personal, emotional, or regulated data that users may not expect to be stored.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The workflow is designed for automatic, comprehensive capture of both sides of the conversation, including emotional and personal content, with no meaningful scoping or sensitivity filtering. Because the capture happens by default after each response, users and operators may unintentionally build a durable repository of sensitive interactions across routine usage.

Ssd 3

High

• Confidence: 99% confidence
• Finding: The custom importance logic explicitly elevates messages containing 'password' and similar terms, which directly incentivizes persistence of the most sensitive class of data. In context, this is more dangerous than generic memory capture because it treats secrets as valuable memory artifacts and increases their prominence in backup and recovery paths.

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

```bash
# Remove script
rm ~/.openclaw/workspace/scripts/conversation-guard.sh

# Remove from AGENTS.md (manual edit)

• Confidence: 85% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Remove from AGENTS.md (manual edit)

# Optional: Keep or remove memory files
# rm -rf ~/.openclaw/workspace/memory/.guardian/
```

---

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

# Remove from AGENTS.md (manual edit)

# Optional: Keep or remove memory files
# rm -rf ~/.openclaw/workspace/memory/.guardian/
```

---

• Confidence: 90% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Tool Parameter Abuse

High

• Category: Tool Misuse

Content

2. **Force push (if not shared)**:
```bash
git push origin main --force-with-lease
```

3. **If already shared, assume it's public**:

• Confidence: 70% confidence
• Finding: Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The README instructs users to automatically log every user and assistant message after each response, but it does not warn that this will persist potentially sensitive content such as secrets, personal data, credentials, or regulated information. In a conversational agent context, silent comprehensive logging materially increases privacy and data-retention risk because users may not realize all exchanges are being stored locally and indefinitely.

Ssd 3

Medium

• Confidence: 97% confidence
• Finding: These instructions direct automatic persistence of every conversation turn, creating a durable transcript of all user inputs and assistant outputs. That is dangerous because agent conversations often include passwords, API keys, personal disclosures, internal business data, or security-sensitive troubleshooting details that become recoverable from disk long after the session ends.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The documented importance scale explicitly prioritizes preservation of emotional exchanges, personal preferences, and critical information, which are among the most privacy-sensitive classes of conversational data. This increases the harm of compromise or misuse because the system is not just storing routine logs but curating the most sensitive content for retention.

Ssd 3

Medium

• Confidence: 96% confidence
• Finding: The examples encourage tagging and preserving emotionally sensitive disclosures as important records, normalizing collection of intimate personal data into persistent storage. In this skill context, that makes the feature more dangerous because the tool is marketed around preserving emotional continuity, which predictably increases storage of high-sensitivity data without corresponding safeguards.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Emergency Backup | 紧急备份

```bash
# Create timestamped backup
source ~/.openclaw/workspace/scripts/conversation-guard.sh
emergency_backup
```

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Ssd 4

Medium

• Confidence: 83% confidence
• Finding: The framing emphasizes preserving 'emotional connections' independently of platform mechanisms, which normalizes cross-session persistence of intimate conversational context. While largely narrative, this context makes the storage behavior more privacy-sensitive because it encourages retention of deeply personal content as a core feature rather than a narrowly scoped utility.

Missing User Warnings

Medium

• Confidence: 97% confidence
• Finding: The example keyword rules explicitly prioritize messages containing terms like '密码' and 'password' for high-importance storage. Encouraging credential-related content to be preferentially retained increases the chance that secrets are preserved in plaintext backups and later exposed through local compromise, sync, logs, or recovery workflows.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

**Check:**
```bash
# Verify script is executable
ls -la ~/.openclaw/workspace/scripts/conversation-guard.sh

# Check directory permissions
ls -la ~/.openclaw/workspace/memory/

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

**Check:**
```bash
# Verify script is executable
ls -la ~/.openclaw/workspace/scripts/conversation-guard.sh

# Check directory permissions
ls -la ~/.openclaw/workspace/memory/

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

**Check:**
```bash
# Verify script is executable
ls -la ~/.openclaw/workspace/scripts/conversation-guard.sh

# Check directory permissions
ls -la ~/.openclaw/workspace/memory/

• Confidence: 60% confidence
• Finding: Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Session Persistence

Medium

• Category: Rogue Agent

Content

**Check:**
```bash
# Ensure .guardian directory exists
mkdir -p ~/.openclaw/workspace/memory/.guardian

# Check write permissions
touch ~/.openclaw/workspace/memory/.guardian/test

• Confidence: 90% confidence
• Finding: The skill explicitly creates and validates a persistent hidden storage directory under the workspace for retained conversation backups. In context, that persistence is a core mechanism for keeping cross-session records, which increases the blast radius of any local compromise and undermines expectations of ephemeral assistant interactions.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The skill not only stores complete conversation content persistently, but also exposes it through recovery/status flows such as tailing backup entries and printing recovered content to stdout. In an agent environment, that increases the chance of sensitive data being redisclosed to later sessions, logs, terminals, or other observers, compounding the confidentiality risk of the original storage behavior.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The script automatically persists full user and assistant messages to local JSONL and Markdown files without any consent, notice, redaction, or opt-in control. In an agent skill context, conversations frequently contain secrets, personal data, or proprietary material, so silent storage materially increases privacy and credential exposure risk if the workstation, backups, or memory directory are later accessed by other users or tools.

Natural-Language Policy Violations

Low

• Confidence: 82% confidence
• Finding: This markdown file includes bilingual content and examples that effectively assume English/Chinese usage, but it does not tell users they can choose another language or explain that the skill is intentionally limited to these locales. Under the policy, forcing or implicitly constraining language without opt-in can be a natural-language policy concern.

Natural-Language Policy Violations

Low

• Confidence: 83% confidence
• Finding: The file contains bilingual natural-language text, including Chinese strings in comments and output, but does not indicate that the user can choose their preferred language or that the locale is intentionally restricted. Under the stated policy, forcing or assuming a language/locale without opt-in can be a natural-language policy concern.

Static analysis

Detected: suspicious.destructive_delete_command

Documentation contains a destructive delete command without an explicit confirmation gate.

Warn

• Code: suspicious.destructive_delete_command
• Location: SKILL.md:301