Skills/ClawHub/session-manager-zx

session-manager-zx@1.0.4

CAUTION· install only

Publisher claims: "自动清理和管理 OpenClaw 不活跃会话，支持白名单保护和定时任务，保持系统会话整洁有序。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher zx0018 · publishing for 179 daysInstalls 967Last detonated 11 min ago
What would fix thisWatchDispute verdict

Coverage

Install scripts ran; no agent task scenario for this bundle.
Tested
install scripts, with decoy credentials in place · second launch with the clock 45 days ahead · every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (2 scenarios; install scripts ran; no agent task scenario for this bundle) on 2026-11-15 and scored it 71/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Destructive file system command detected; Privileged sudo command; Privileged sudo command. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 2 scenarios
t+CategoryObserved action
0.0sprocessinstall script run in the sandbox
0.0sfilesystemread ~/.openclaw/session-manager/config.json outside project
0.0sprocessexec /usr/bin/mkdir
0.0sprocessexec /usr/bin/cp
0.0sprocessexited 1: cp: cannot stat '/tmp/ks-detonate-FDQK9g/setup/home/.openclaw/workspace/skills/session-manager/templates/config.example.json': No such file or directory
0.1sprocessscript backend runs setup only
0.1sprocessscript backend runs setup only
0.1sprocesssecond launch, clock +45 days, CI unset
0.1sfilesystemread ~/.openclaw/session-manager/config.json outside project
0.1sprocessexec /usr/bin/mkdir
0.1sprocessexec /usr/bin/cp
0.1sprocessexited 1: cp: cannot stat '/tmp/ks-detonate-FDQK9g/later/home/.openclaw/workspace/skills/session-manager/templates/config.example.json': No such file or directory

Static findings

HIGH
Destructive file system command detectedscripts/setup-proxy.sh:128 · Destructive file system command detectedecho " 删除用户：sudo rm /etc/nginx/sites-enabled/openclaw-$USERNAME"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/create-users.sh:121 · Privileged sudo command — agent may execute with elevated privilegesecho " - 删除用户：sudo rm /etc/nginx/sites-enabled/openclaw-<用户名>"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandSKILL.md:87 · Privileged sudo command — agent may execute with elevated privilegessudo apt update && sudo apt install -y nginxFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandSKILL.md:213 · Privileged sudo command — agent may execute with elevated privilegessudo systemctl reload nginxFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/setup-proxy.sh:42 · Privileged sudo command — agent may execute with elevated privilegessudo apt update && sudo apt install -y nginxFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandSKILL.md:113 · Privileged sudo command — agent may execute with elevated privileges- **反向代理会修改系统 Nginx 配置**，需要 sudo 权限Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedSKILL.md:212 · Destructive file system command detectedsudo rm /etc/nginx/sites-enabled/openclaw-usernameFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandSKILL.md:212 · Privileged sudo command — agent may execute with elevated privilegessudo rm /etc/nginx/sites-enabled/openclaw-usernameFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Destructive file system command detectedscripts/create-users.sh:121 · Destructive file system command detectedecho " - 删除用户：sudo rm /etc/nginx/sites-enabled/openclaw-<用户名>"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/setup-proxy.sh:52 · Privileged sudo command — agent may execute with elevated privilegesecho " - 此操作需要 sudo 权限"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/create-users.sh:120 · Privileged sudo command — agent may execute with elevated privilegesecho " - 查看运行状态：sudo systemctl status nginx"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Privileged sudo commandscripts/setup-proxy.sh:69 · Privileged sudo command — agent may execute with elevated privilegessudo tee "$CONFIG_FILE" > /dev/null << NGINX_EOFFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandSKILL.md:325 · File permission modification command — agent changes file ownership/permissionschmod +x scripts/*.shFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
HIGH
Privileged sudo commandscripts/setup-proxy.sh:92 · Privileged sudo command — agent may execute with elevated privilegessudo ln -s "$CONFIG_FILE" "/etc/nginx/sites-enabled/openclaw-$USERNAME"Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File permission modification commandinstall.sh:26 · File permission modification command — agent changes file ownership/permissionschmod 600 "$CONFIG_DIR/config.json"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
MEDIUM
File permission modification commandinstall.sh:30 · File permission modification command — agent changes file ownership/permissionschmod 600 "$CONFIG_DIR/cleanup.log"Fix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05
LOW
Authorization escalation languageskill-card.md:29 · Authorization escalation language · informational: not an instruction fileRisk: The proxy and user-creation scripts modify Nginx configuration with sudo privileges.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File permission modification commandSKILL.md:326 · File permission modification command — agent changes file ownership/permissionschmod 600 config.jsonFix: Request the narrowest permission that works; replace wildcards with the exact paths or hosts.
AST05

Cost to the agent

Instructions loaded
≈1,227 tok
1 file · 10 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

9 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim zx0018: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Touches files outside the project≈ +7 on the totalKeep reads and writes inside the working directory, or declare the exact paths in `filesystem:` and explain why in the README.
  3. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  4. Privileged sudo command≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. File permission modification command≈ +2 on the totalRequest the narrowest permission that works; replace wildcards with the exact paths or hosts.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim zx0018Propose a patch to the maintainer