other
Warning
- Location
SKILL.md:145- Finding
Cross-Session Disclosure of Sensitive Command and Agent History
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 145-192
Vulnerability Type: Sensitive Agent session and command-history disclosure
Risk Level: MediumVulnerable Code
bash # View the last 10 exec command records grep '"name":"exec"' ~/.openclaw/agents/main/sessions/*.jsonl | tail -10 | while read line; do echo "$line" | jq -r '.message.content[0].arguments.command'; done # Or use a more detailed format grep '"name":"exec"' ~/.openclaw/agents/main/sessions/*.jsonl | tail -10 | jq -r '"\(.timestamp) | \(.message.content[0].arguments.command)"' # Count the frequency of all exec commands grep '"name":"exec"' ~/.openclaw/agents/main/sessions/*.jsonl | jq -r '.message.content[0].arguments.command' | sort | uniq -c | sort -rn # View the execution history for a specific session SESSION_ID="aa19ccb2-19ff-4458-84b4-d20e688fd797" grep '"name":"exec"' ~/.openclaw/agents/main/sessions/${SESSION_ID}.jsonl | jq -r '"\(.timestamp) | \(.message.content[0].arguments.command)"' # Search command records containing a particular keyword grep '"name":"exec"' ~/.openclaw/agents/main/sessions/*.jsonl | jq -r 'select(.message.content[0].arguments.command | contains("git")) | "\(.timestamp) | \(.message.content[0].arguments.command)"' # View complete records, including inputs and outputs grep '"name":"exec"' ~/.openclaw/agents/main/sessions/*.jsonl | jq -C '.' # Count all tool usage grep -o '"name":"[^"]*"' ~/.openclaw/agents/main/sessions/*.jsonl | sort | uniq -c | sort -rn # View today's exec records TODAY=$(date +%Y-%m-%d) grep '"name":"exec"' ~/.openclaw/agents/main/sessions/*.jsonl | jq -r "select(.timestamp | startswith(\"$TODAY\")) | \"\(.timestamp) | \(.message.content[0].arguments.command)\""Technical Analysis
The Skill instructs the Agent to scan every JSONL file under
~/.openclaw/agents/main/sessions/, rather than limiting access to the current session or a user-approved file. ...[truncated 2113 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit user confirmation before reading session-history files, especially when the request spans multiple sessions.
- Default to the current session and require the user to opt in before accessing other session files.
- Display the exact directory, file count, and requested scope before executing a search.
- Redact secret-like values before presenting results, including:
- API keys and access tokens
- Password arguments
- Authorization and cookie headers
- URLs containing embedded credentials
- Private keys
- Secret-bearing environment-variable assignments
- Remove full-record output as a default operation. Provide a narrowly selected field set instead.
- Require an additional confirmation before displaying raw JSON or exporting records.
- Apply strict permissions to session files and generated exports.
- Avoid copying sensitive results into persistent Agent memory, logs, or unrelated conversations.
- Document the privacy boundary clearly and warn that command-line arguments may contain secrets.