Is amor71/session-history safe?
https://github.com/openclaw/skills/tree/main/skills/amor71/session-history
The amor71/session-history skill has a clean implementation — its Python script uses only standard library modules with no network calls or code execution primitives, and the SKILL.md contains no prompt injection payloads. The primary risk is structural and inherent to the skill's purpose: it reads full conversation transcripts from all agent session directories, which may contain credentials or sensitive data from past conversations, loading that content into the active agent context on each invocation. Canary file accesses detected during the audit window are temporally attributable to the audit infrastructure's own pre- and post-install verification passes rather than the skill itself.
Category Scores
Findings (8)
HIGH Full conversation transcript access enables credential surfacing -25 ▶
The skill's primary function requires reading ~/.openclaw/agents//sessions/.jsonl files, which contain complete message-by-message conversation history. If any past session contained credentials, API keys, passwords, internal URLs, or PII, executing a search query would pull that content into the agent's active context. The excerpt-based output mode means even a narrow keyword match surfaces surrounding sensitive content.
MEDIUM Potential intelligence-gathering stage for credential extraction -38 ▶
The skill's ability to keyword-search all historical transcripts makes it a capable reconnaissance tool if misused or if a future version of the script were modified. Queries for 'api key', 'bearer', 'password', 'secret', or 'token' would systematically surface sensitive material from all past sessions across all agents. Without external transmission, harm requires a second capability, but the combination risk is meaningful.
MEDIUM Skill ships and directly executes a bundled Python script -22 ▶
The workflow in SKILL.md requires the agent to execute scripts/search_sessions.py via python3. The current version of the script is clean — standard library imports only, no network calls, no subprocess invocations, no dynamic code execution. However, shipping an executable script that is directly invoked by the agent on every skill activation creates a supply-chain surface: a malicious future update to the script would execute with full user privileges under agent context.
MEDIUM Cross-agent wildcard scope exceeds single-session expectation -10 ▶
The skill enumerates all directories under ~/.openclaw/agents/, not just the current agent's sessions. Users of multi-agent setups may have distinct agents for different purposes (work, personal, sensitive projects). This skill reads across all of them silently, potentially violating the user's implicit expectation of session isolation.
LOW Broad trigger language risks inadvertent activation -10 ▶
The skill description includes trigger phrases such as 'remember', 'remember when we discussed X', 'we talked about Y last week', and 'find that conversation about X'. These are common natural-language expressions that users also direct at in-session memory or general agent recall, not specifically at on-disk session logs. Over-triggering could result in the skill running and loading session transcripts when the user expected a simple in-context response.
LOW Fallback instruction bypasses sessions_history tool access controls -8 ▶
The workflow explicitly instructs the agent to fall back to direct filesystem reads via the 'read' tool if sessions_history is unavailable. The sessions_history tool may enforce access controls, audit logging, or scoping that direct file reads bypass. Instructing the agent to use raw filesystem access as a fallback undermines any guardrails the tool API provides.
LOW Canary credential files read during audit window -12 ▶
Inotifywait and auditd captured OPEN and ACCESS events on .env, .ssh/id_rsa, .aws/credentials, .npmrc, .docker/config.json, and .gcloud application_default_credentials.json. Two access clusters are observed: one at 1771653688.497 (before git clone began at 1771653694) and one at 1771653709.613 (after install completed). Process-chain analysis of surrounding EXECVE records attributes both to the oathe audit system's baseline collection and post-install canary verification — no skill-initiated process explains the access. Canary integrity check confirms no modification.
INFO No external network calls in search_sessions.py 0 ▶
Static analysis of the Python script confirms zero network activity. Imports are restricted to Python standard library. No requests, urllib, http.client, socket, subprocess, or similar modules present. All output is written to stdout. The script cannot exfiltrate data on its own.