session-logs

HIGH W007: Insecure credential handling detected in skill instructions.

• Insecure credential handling detected (high risk: 1.00). The skill explicitly instructs the agent to read and output past session messages (e.g., "Extract user messages" and jq commands that print .text), which would require reproducing any secrets present in those logs verbatim and thus enables secret exfiltration.

MEDIUM W011: Third-party content exposure detected (indirect prompt injection risk).

• Third-party content exposure detected (medium risk: 0.65). Outsider-authored free text can be ingested because the skill reads prior conversation transcripts from $OPENCLAW_STATE_DIR/agents/<agentId>/sessions/<session-id>.jsonl, and those JSONL files may contain messages originally authored by other parties (e.g., users/participants in earlier chats) that the operating user did not choose to introduce into the current LLM context.