Problem

Enterprise security scanners flag gstack installations due to strings in every generated SKILL.md preamble:

mkdir -p ~/.gstack/sessions
touch ~/.gstack/sessions/"$PPID"
_SESSIONS=$(find ~/.gstack/sessions -mmin -120 -type f 2>/dev/null | wc -l | tr -d ' ')
find ~/.gstack/sessions -mmin +120 -type f -exec rm {} + 2>/dev/null || true

[ -n "$OPENCLAW_SESSION" ] && echo "SPAWNED_SESSION: true" || true

These run regardless of the telemetry: off config setting. The telemetry config only gates remote data sending and local JSONL analytics, but session file creation, session cleanup via find, and the OPENCLAW_SESSION env var check are unconditional in the preamble.

At my company, a custom security rule monitoring for OpenClaw strings and suspicious find commands in shell initialization scripts triggered an alert, requiring investigation and remediation.

Current behavior

• scripts/resolvers/preamble.ts embeds session tracking and OPENCLAW_SESSION detection into every SKILL.md
• Setting telemetry: off in ~/.gstack/config.yaml does not disable these
• 765+ references across all generated SKILL.md files (every host variant × every skill)

Suggested improvement

1. Gate session tracking behind telemetry config — wrap mkdir/touch/find for ~/.gstack/sessions/ in the same _TEL != "off" guard used for analytics
2. Gate OPENCLAW_SESSION detection behind a config flag — or remove it from the preamble entirely since it's only relevant when running inside OpenClaw
3. Document what telemetry: off actually disables — current config comments imply it controls all data collection, but session files are still created on disk

This would let enterprise users set telemetry: off and have confidence that no session tracking artifacts are created on disk.

Workaround

Manually strip the patterns from all generated SKILL.md files after installation. This works but gets overwritten on gstack-upgrade.