Conversation Guard

• Outcome: Review
• Latest audit: Sep 11, 2026 · 6:08 PM UTC
• Version: 0.1.0

Overview

The skill is a disclosed local conversation backup tool, but it asks agents to automatically persist complete chats and installs executable shell code from a mutable remote URL without integrity checks.

Install only if you intentionally want every agent exchange copied into local plaintext history. Review or replace the install commands so they use the bundled script or a pinned verified release, add redaction for passwords/tokens/private data, restrict file permissions, and define how long conversation backups should be kept.

A.I.G

Vulnerability Patterns

• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T03 · Remote Payload Retrieval and Execution

Error

• Location: SKILL.md:23

Finding

Mutable Remote Shell Script Is Retrieved and Executed Without Integrity Verification

Content

View full analysis

Remediation

View remediation

/conversation-guard.sh' ``` 5. Verify the temporary file before replacing the installed script: ```bash printf '%s %s\n' "$EXPECTED_SHA256" conversation-guard.sh.tmp | sha256sum --check - ``` 6. Install the verified file atomically and with an explicit mode: ```bash install -m 0700 conversation-guard.sh.tmp \ "$HOME/.openclaw/workspace/scripts/conversation-guard.sh" ``` 7. Apply the same controls to the update procedure, and never overwrite a trusted executable until verification succeeds. 8. Consider executing the script as a constrained subprocess rather than sourcing it when access to the caller's complete shell environment is unnecessary. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: conversation-guard.sh:70

Finding

Complete Conversations Are Persisted in Plaintext Without Enforced Private Permissions

Content

View full analysis

/dev/null || echo "\"$user_msg\"") local assistant_json=$(echo "$assistant_msg" | python3 -c 'import json,sys; print(json.dumps(sys.stdin.read()))' 2>/dev/null || echo "\"$assistant_msg\"") # Write to JSONL backup echo "{\"t\":\"$timestamp\",\"r\":\"user\",\"c\":$user_json,\"i\":$importance,\"g\":\"$tags\"}" >> "$BACKUP_FILE" echo "{\"t\":\"$timestamp\",\"r\":\"assistant\",\"c\":$assistant_json,\"i\":$importance,\"g\":\"$tags\"}" >> "$BACKUP_FILE" # Write to Markdown (human-readable) { echo "**👤 USER** ($timestamp)" echo "" echo "$user_msg" echo "" echo "**🌙 ASSISTANT** ($timestamp)" echo "" echo "$assistant_msg" echo "" # Add emotional marker for high importance if [ "$importance" -ge 8 ]; then echo "" echo "" fi echo "---" echo "" } >> "$TODAY_FILE" # Emergency log for critical conversations if [ "$importance" -ge 9 ]; then echo "$(date '+%Y%m%d_%H%M%S') [IMPORTANCE:$importance] [$tags]" >> "${GUARDIAN_DIR}/.emergency_log.txt" fi } ``` The recommend ...[truncated 2503 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (22)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill instructs the agent to automatically record every user message and assistant response to persistent local storage after each exchange, but it provides no explicit consent flow, privacy notice, retention limit, or redaction guidance. This creates a clear risk of silently capturing sensitive personal, emotional, or regulated data that users may not expect to be stored.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The workflow is designed for automatic, comprehensive capture of both sides of the conversation, including emotional and personal content, with no meaningful scoping or sensitivity filtering. Because the capture happens by default after each response, users and operators may unintentionally build a durable repository of sensitive interactions across routine usage.

Content

No source excerpt is available for this finding.

Ssd 3

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The custom importance logic explicitly elevates messages containing 'password' and similar terms, which directly incentivizes persistence of the most sensitive class of data. In context, this is more dangerous than generic memory capture because it treats secrets as valuable memory artifacts and increases their prominence in backup and recovery paths.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 85% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 296)May include surrounding context.

bash

# Remove script
rm ~/.openclaw/workspace/scripts/conversation-guard.sh

# Remove from AGENTS.md (manual edit)

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

Remove from AGENTS.md (manual edit)

Optional: Keep or remove memory files

rm -rf ~/.openclaw/workspace/memory/.guardian/

text

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 90% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · SKILL.md (reported line 301)May include surrounding context.

Remove from AGENTS.md (manual edit)

Optional: Keep or remove memory files

rm -rf ~/.openclaw/workspace/memory/.guardian/

text

---

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 70% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · VERSION-ISOLATION.md (reported line 241)May include surrounding context.

2. Force push (if not shared):

bash

git push origin main --force-with-lease

3. If already shared, assume it's public:

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The README instructs users to automatically log every user and assistant message after each response, but it does not warn that this will persist potentially sensitive content such as secrets, personal data, credentials, or regulated information. In a conversational agent context, silent comprehensive logging materially increases privacy and data-retention risk because users may not realize all exchanges are being stored locally and indefinitely.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

These instructions direct automatic persistence of every conversation turn, creating a durable transcript of all user inputs and assistant outputs. That is dangerous because agent conversations often include passwords, API keys, personal disclosures, internal business data, or security-sensitive troubleshooting details that become recoverable from disk long after the session ends.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The documented importance scale explicitly prioritizes preservation of emotional exchanges, personal preferences, and critical information, which are among the most privacy-sensitive classes of conversational data. This increases the harm of compromise or misuse because the system is not just storing routine logs but curating the most sensitive content for retention.

Content

No source excerpt is available for this finding.

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The examples encourage tagging and preserving emotionally sensitive disclosures as important records, normalizing collection of intimate personal data into persistent storage. In this skill context, that makes the feature more dangerous because the tool is marketed around preserving emotional continuity, which predictably increases storage of high-sensitivity data without corresponding safeguards.

Content

No source excerpt is available for this finding.

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 60% confidence

Finding

Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Content

Scanner excerpt · README.md (reported line 156)May include surrounding context.

Emergency Backup | 紧急备份

bash

# Create timestamped backup
source ~/.openclaw/workspace/scripts/conversation-guard.sh
emergency_backup

Ssd 4

Medium

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The framing emphasizes preserving 'emotional connections' independently of platform mechanisms, which normalizes cross-session persistence of intimate conversational context. While largely narrative, this context makes the storage behavior more privacy-sensitive because it encourages retention of deeply personal content as a core feature rather than a narrowly scoped utility.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 97% confidence

Finding

The example keyword rules explicitly prioritize messages containing terms like '密码' and 'password' for high-importance storage. Encouraging credential-related content to be preferentially retained increases the chance that secrets are preserved in plaintext backups and later exposed through local compromise, sync, logs, or recovery workflows.

Content

No source excerpt is available for this finding.

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 209)May include surrounding context.

Check:

bash

# Verify script is executable
ls -la ~/.openclaw/workspace/scripts/conversation-guard.sh

# Check directory permissions
ls -la ~/.openclaw/workspace/memory/

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 212)May include surrounding context.

Check:

bash

# Verify script is executable
ls -la ~/.openclaw/workspace/scripts/conversation-guard.sh

# Check directory permissions
ls -la ~/.openclaw/workspace/memory/

File System Enumeration

Medium

• Category: Data Exfiltration
• Confidence: 60% confidence

Finding

Code scans file system directories looking for sensitive files. This could be reconnaissance for credential theft.

Content

Scanner excerpt · SKILL.md (reported line 236)May include surrounding context.

Check:

bash

# Verify script is executable
ls -la ~/.openclaw/workspace/scripts/conversation-guard.sh

# Check directory permissions
ls -la ~/.openclaw/workspace/memory/

Session Persistence

Medium

• Category: Rogue Agent
• Confidence: 90% confidence

Finding

The skill explicitly creates and validates a persistent hidden storage directory under the workspace for retained conversation backups. In context, that persistence is a core mechanism for keeping cross-session records, which increases the blast radius of any local compromise and undermines expectations of ephemeral assistant interactions.

Content

Scanner excerpt · SKILL.md (reported line 224)May include surrounding context.

Check:

bash

# Ensure .guardian directory exists
mkdir -p ~/.openclaw/workspace/memory/.guardian

# Check write permissions
touch ~/.openclaw/workspace/memory/.guardian/test

Ssd 3

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The skill not only stores complete conversation content persistently, but also exposes it through recovery/status flows such as tailing backup entries and printing recovered content to stdout. In an agent environment, that increases the chance of sensitive data being redisclosed to later sessions, logs, terminals, or other observers, compounding the confidentiality risk of the original storage behavior.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The script automatically persists full user and assistant messages to local JSONL and Markdown files without any consent, notice, redaction, or opt-in control. In an agent skill context, conversations frequently contain secrets, personal data, or proprietary material, so silent storage materially increases privacy and credential exposure risk if the workstation, backups, or memory directory are later accessed by other users or tools.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

This markdown file includes bilingual content and examples that effectively assume English/Chinese usage, but it does not tell users they can choose another language or explain that the skill is intentionally limited to these locales. Under the policy, forcing or implicitly constraining language without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Low

• Category: Not specified by scanner
• Confidence: 83% confidence

Finding

The file contains bilingual natural-language text, including Chinese strings in comments and output, but does not indicate that the user can choose their preferred language or that the locale is intentionally restricted. Under the stated policy, forcing or assuming a language/locale without opt-in can be a natural-language policy concern.

Content

No source excerpt is available for this finding.