Terminal Session Replay

Record and replay terminal sessions for debugging, documentation, or sharing procedures with teammates.

This skill appears to do what it claims: record and replay terminal sessions locally. Before installing or using it, consider the following: (1) recordings capture everything you type/see (including passwords and secrets) — avoid recording sensitive sessions or securely delete/encrypt recordings afterward; (2) session files are stored by default in ~/.terminal-sessions — check and restrict filesystem permissions and add that path to backups/.gitignore if needed; (3) the tool invokes the system 'script' and 'scriptreplay' binaries — ensure those are the expected system utilities (not maliciously replaced on your PATH); (4) you can review scripts/main.py (provided) and run the tool in a sandbox/container if you want to test in isolation; (5) no network exfiltration or external credentials are requested by the skill, but treat recordings as sensitive data and manage accordingly.

Type: OpenClaw Skill Name: terminal-session-replay Version: 1.0.0 The skill provides terminal session recording and replay functionality by wrapping the 'script' and 'scriptreplay' utilities. It is classified as suspicious due to an arbitrary file write vulnerability in the 'export' command within 'scripts/main.py', where the output file path is not validated, potentially allowing an attacker to overwrite sensitive files via prompt injection. While the tool implements robust path traversal checks for session names and uses secure subprocess calls, the lack of sanitization on the export destination is a high-risk vulnerability. No evidence of intentional malicious intent or data exfiltration was found.