T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:25- Finding
Automatic Retrieval Across Agent Memory and Session Indexes Without Access Controls
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 25-41 and 59-62
Vulnerability Type: Unrestricted retrieval of historical memory and indexed session data
Risk Level: MediumVulnerable Instructions
The following is an English translation of the relevant source instructions; shell commands and paths are preserved:
markdown ### 2. Select a retrieval method **Preferred: QMD search** ```bash qmd search "search terms" --limit 5Fallback: Memory search
bash # Search memory files grep -r "search terms" ~/.openclaw/workspace/memory/ # Alternatively, use memory_search3. Return results
Organize the search results and return them to the user.
text The configuration also states that QMD indexes include the workspace, Butler, researcher, and sessions, while memory files are read automatically. ### Technical Analysis The skill instructs the agent to search persistent memory and QMD indexes automatically whenever a request appears related to historical information. The searched sources explicitly include session data and multiple indexed scopes. No authorization check, current-user ownership validation, session isolation, path allowlist, sensitivity classification, or confirmation requirement is specified before retrieval. The fallback command recursively searches the entire Agent memory directory rather than a narrowly scoped file or user-specific namespace. The instructions then direct the agent to return the resulting information to the requester without requiring redaction or relevance-based disclosure controls. This violates least-privilege principles because a broad conversational trigger can cause access to historical information beyond what is strictly necessary for the request. Whether cross-user disclosure is practically possible depends on the runtime's QMD index and filesystem isolation; the reviewed file alone does not establish that multiple users' records ...[truncated 1394 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit user confirmation before accessing persistent memory or previous sessions.
- Bind every retrieval request to an authenticated user, tenant, and authorized session namespace.
- Restrict QMD searches to the current user's approved indexes; exclude cross-role and historical-session indexes by default.
- Replace recursive searches of the entire memory directory with an allowlisted, user-specific path.
- Apply sensitivity detection and redact credentials, authentication tokens, personal information, and unrelated private content before returning results.
- Return only the minimum relevant excerpts rather than complete records or files.
- Treat history-related phrases as indicators of intent, not as authorization to access stored data.
- Record retrieval events in an audit log containing the requester, authorized scope, query, accessed sources, and disclosed records.
- Define retention and deletion controls for memory and session indexes so obsolete sensitive content is not indefinitely searchable.
- If safe isolation cannot be guaranteed, disable automatic retrieval and require users to identify an explicitly authorized record or session.