Session Archive

Security checks across static analysis, malware telemetry, and agentic risk

Overview

The plugin's code, docs, and runtime behavior align with its stated purpose (archiving conversations to a local SQLite DB); it does not request credentials or reach out to remote endpoints, but it will store full conversation content locally so protect the DB file.

This plugin appears to do what it says: record messages, token usage, and operations into a local SQLite database. Before installing: 1) Remember the DB will contain full conversation text and metadata — choose a secure path, set strict file permissions, and consider encrypting or limiting retention for sensitive data. 2) Inspect the published package (npm or OpenClaw registry) to confirm the packaged files match the repository and that the package-lock does not embed unexpected dependencies. 3) better-sqlite3 is a native dependency and may require a build toolchain — verify it builds correctly on your system. 4) If you are concerned about other plugins calling engine.recordOperation or writing sensitive entries, restrict plugin usage or run in an isolated environment. If you want stronger guarantees, review the included source files (src/*.ts and dist/*.js) yourself or test in a sandbox before enabling in production.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

No VirusTotal findings

View on VirusTotal

Risk analysis

No visible risk-analysis findings were reported for this release.