Openclaw History Viewer

启动一个 web 服务来浏览和查看 OpenClaw 的历史聊天记录。支持会话列表、消息详情查看、JSON API 导出、自动会话备份、刷新功能。使用场景：当用户想要查看、浏览、搜索或导出 OpenClaw 的聊天历史记录时触发此技能。触发词包括："启动历史记录"、"打开聊天记录"、"查看历史"、"启动 hist...

This skill largely does what it says: starts a local web server to view OpenClaw session files and can create backups. Before installing or running it, do the following: 1) Inspect the remainder of history_server.py (the truncated portion) to confirm whether the HTTP server binds only to localhost (127.0.0.1) or to all interfaces — you should ensure it binds to localhost if you don't want remote access. 2) Search the code for any POST/DELETE endpoints or handlers that expose delete_session or file-write operations via HTTP; if present, confirm whether they require authentication or are intentionally disabled. 3) If you plan to run it, run as your regular (non-root) user and not on a publicly routable interface; consider using firewall rules or an SSH tunnel if you need remote access. 4) Backup scripts write to ~/.openclaw/workspace/history/ and create/modify backup_index.json; if you keep sensitive data, review those files and permissions. If you are not comfortable auditing the full server code (especially missing parts), treat this as potentially risky and avoid running it on production or multi-user machines.

Type: OpenClaw Skill Name: openclaw-history-viewer Version: 1.1.1 The skill bundle provides a web-based viewer for OpenClaw chat history but contains significant security vulnerabilities and documentation discrepancies. While the functionality aligns with its stated purpose, `history_server.py` binds the web server to all network interfaces ('0.0.0.0'), directly contradicting the 'local access only' claim in `SKILL.md` and potentially exposing sensitive chat logs to the network. Furthermore, the server includes a session deletion feature (`/api/delete`) that lacks any authentication or CSRF protection, allowing for unauthorized data destruction. These flaws, while likely unintentional, constitute high-risk behaviors in a tool handling private conversation data.