openclaw-history-ingest
Pass
Audited by Gen Agent Trust Hub on Oct 6, 2026
Risk Level: SAFEINDIRECT_PROMPT_INJECTION
Full Analysis
- [INDIRECT_PROMPT_INJECTION]: The skill ingests external data from OpenClaw session transcripts (
.jsonlfiles) and memory logs (MEMORY.md). This data is untrusted and could contain malicious instructions designed to influence the agent during the ingestion and distillation process. - Ingestion points: Processes files from
~/.openclaw/workspace/and~/.openclaw/agents/*/sessions/. - Boundary markers: The skill lacks explicit structural delimiters (e.g., XML tags or unique separators) to isolate the ingested history content from the agent's instructions.
- Capability inventory: The skill possesses filesystem write capabilities (Obsidian vault updates) and execution of local CLI tools (
obsidian-wiki,qmd). - Sanitization: The instructions include a 'Critical privacy filter' and a 'summarize; do not quote raw' rule, which provides some mitigation against verbatim execution of injected payloads, but does not fully eliminate the risk of the agent following instructions embedded in the logs.
Audit Metadata