T05 · Unauthorized Access and Privilege Escalation
- Location
_meta.json:29- Finding
Unnecessary Command-Execution Capability and Contradictory Global Update Guidance
- Content
View full analysis
Vulnerability Details
File Location:
_meta.json:29-38,SKILL.md:22-25, andSKILL.md:315-322
Vulnerability Type: Excessive privilege declaration and unsafe command-execution guidance
Risk Level: MediumEvidence
_meta.json:29-38declares command-execution capability even though the implemented analysis, release retrieval, backup, and reporting workflows do not execute system commands:json "capabilities": [ "file_read", "file_write", "exec", "web_fetch" ], "permissions": { "workspace": "read-write", "network": "github.com", "exec": "limited" },SKILL.md:22-25explicitly states that the Skill does not perform OpenClaw updates:markdown ### 我们不做: - ❌ 不执行 OpenClaw 更新 - ❌ 不自动更新技能包 - ❌ 不修改系统配置However,
SKILL.md:315-322presents an Agent-executable global update operation:javascript // 升级前 const analysis = await openclaw.updateChecker.analyze(); if (analysis.impactSummary.high === 0) { console.log('✅ 可以安全升级'); await openclaw.exec({ command: 'pnpm add -g openclaw@latest' }); } else { console.log('⚠️ 存在兼容性问题，请先处理'); }Technical Analysis
The Skill's implemented functionality in
index.jsrequires workspace file access and outbound access to the GitHub Releases API. It does not invokechild_process,exec,spawn, or an equivalent command-execution API. Therefore, declaring theexeccapability exceeds the minimum privileges necessary for its legitimate purpose.The documentation compounds this least-privilege violation by instructing an Agent to invoke
openclaw.execwithpnpm add -g openclaw@latest. This conflicts with the Skill's stated boundary that it does not execute updates or modify system configuration. A global package installation changes the host environment and may execute package lifecycle scripts supplied by the installed package or its dependencies.The risk is amplified by the implem ...[truncated 1697 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove command execution from the Skill metadata:
json "capabilities": [ "file_read", "file_write", "web_fetch" ], "permissions": { "workspace": "read-write", "network": "github.com" } -
Remove the
openclaw.execcall fromSKILL.md. If upgrade instructions are necessary, display the command only as optional user guidance and clearly state that it requires separate, explicit confirmation. -
Keep the Skill's trust boundary limited to:
- Reading narrowly selected workspace configuration metadata.
- Fetching release information from the fixed official GitHub API endpoint.
- Writing reports and backups within an approved workspace directory.
-
Do not recommend an upgrade merely because the high-risk counter is zero. Parse and evaluate the actual release notes and relevant configuration content before producing a compatibility conclusion.
-
Require an independent confirmation step before any separate update tool performs a global installation. The confirmation should identify the exact command, package source, destination scope, and potential lifecycle-script execution.
-
Add automated tests that fail if production code or Skill instructions introduce
openclaw.exec,child_process,exec, orspawnwithout an explicitly reviewed requirement.
-