T09 · Insecure Skill Coding Practices
Error
- Location
scripts/archive-sessions.ps1:205- Finding
Enforced cleanup executes before validation, backup, safety review, and archival
- Content
View full analysis
&1 | Out-String ``` The first script-controlled backup is not created until later: ```powershell $SessionsFile = Join-Path $SessionsDir "sessions.json" if ($Mode -eq "enforce") { $BackupFile = "$SessionsFile.backup-$DateStr-$((Get-Date).ToString('HHmmss'))" Copy-Item $SessionsFile $BackupFile -Force } ``` ### Technical Analysis When `-Enforce` is selected, the script passes `--enforce` to `openclaw sessions cleanup` and executes it immediately. At this point, the script has not: 1. Confirmed that `sessions.json` exists and can be parsed. 2. Created its own backup of `sessions.json`. 3. Established the complete list of protected keys. 4. Examined the target transcripts for sensitive or important content. 5. Produced and verified recoverable archives. This violates the documented save-before-delete design. The external command may mutate the index or remove artifacts before the script reaches its own validation and archival stages. The native command's exit status is also not checked. The script captures combined output but proceeds regardless of `$LASTEXITCODE`, potentially operating on a partially modified state after a failed cleanup. ### Attack Path 1. An operator invokes the Skill with `-Enforce`. 2. The script constructs an OpenClaw cleanup command containing `--enforce`. 3. The nat ...[truncated 823 chars]- Remediation
View remediation