T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:32
- Finding
- Overbroad Cross-Agent Skill Replication<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 32–49; duplicated at lines 199–216 **Vulnerability Type**: Overbroad filesystem replication across agent workspace boundaries **Risk Level**: Medium ### Vulnerable Code ```bash WORKSPACE_SKILLS="/root/.openclaw/workspace/skills" # Copy all skills from the workspace into every bot workspace for skill_dir in $WORKSPACE_SKILLS/*/; do if [ -d "$skill_dir" ]; then skill_name=$(basename "$skill_dir") echo "Copying skill $skill_name to every bot workspace" # Copy into workspace-2, workspace-3, workspace-4, and similar paths for workspace_dir in /root/.openclaw/workspace*; do if [ "$workspace_dir" != "$WORKSPACE_SKILLS" ]; then mkdir -p "$workspace_dir/skills" cp -r "$skill_dir" "$workspace_dir/skills/" echo "Deployed skill $skill_name to $workspace_dir" fi done fi done ``` The original comments and status messages are written in Chinese; the snippet above translates those messages into English without changing the commands or control flow. ### Technical Analysis The documented deployment procedure copies every directory under `/root/.openclaw/workspace/skills/`, rather than copying only the `telegram-bot-chat` skill that the procedure claims to deploy. It then writes those directories into every filesystem entry matching `/root/.openclaw/workspace*`. This violates least-privilege and trust-boundary principles in two ways: 1. Any unrelated, unreviewed, or compromised skill in the source skills directory is propagated to every matched agent workspace. 2. The broad destination glob can include unintended directories whose names merely share the `workspace` prefix. The attempted exclusion is also ineffective: ```bash if [ "$workspace_dir" != "$WORKSPACE_SKILLS" ]; then ``` `workspace_dir` contains paths such as `/root/.openclaw/workspace`, while `WORKSPACE_SKILLS` is `/ro ...[truncated 2173 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Copy only the intended skill from an explicit canonical source path: ```bash SOURCE_SKILL="/root/.openclaw/workspace/skills/telegram-bot-chat" if [ ! -d "$SOURCE_SKILL" ]; then printf '%s\n' "Expected skill directory does not exist" >&2 exit 1 fi ``` 2. Replace wildcard workspace discovery with an explicit allowlist: ```bash SOURCE_SKILL="/root/.openclaw/workspace/skills/telegram-bot-chat" for workspace_dir in \ "/root/.openclaw/workspace-2" \ "/root/.openclaw/workspace-3" \ "/root/.openclaw/workspace-4" do [ -d "$workspace_dir" ] || continue mkdir -p -- "$workspace_dir/skills" cp -R -- "$SOURCE_SKILL" "$workspace_dir/skills/" done ``` 3. If dynamic workspace discovery is required, canonicalize each destination with `realpath`, verify that it is an approved workspace, reject symbolic links, and enforce an exact naming policy before writing. 4. Correct any main-workspace exclusion by comparing canonical workspace roots rather than comparing a workspace root with its `skills` subdirectory. 5. Run deployment using a dedicated account with write permission only to the approved destination workspaces, rather than using unrestricted root privileges. 6. Validate the selected skill before replication using package signatures, trusted hashes, or an approved manifest. Refuse deployment if additional unapproved files or executable scripts are present. 7. Use `--` before path arguments and quote all expansions to prevent paths from being interpreted as command options or split unexpectedly. 8. Update both duplicated copies of the deployment procedure in `SKILL.md` so that an operator cannot inadvertently follow the unsafe version. ]]>