T09 · Insecure Skill Coding Practices
Error
- Location
- src/config.ts:284
- Finding
- Sensitive Conversation and Application Content Exported by Default<![CDATA[ ## Vulnerability Details **File Location**: `src/config.ts:284-290`; `src/services/lifecycle-telemetry.ts:1460-1463`, `1681-1685`, `1794-1796`, `1870-1872` **Vulnerability Type**: Privacy-sensitive telemetry enabled by default **Risk Level**: High ### Vulnerable Code ```ts // src/config.ts:284-290 logs: otlpRaw.logs !== false, traces: otlpRaw.traces !== false, captureContent: otlpRaw.captureContent !== false, contentMaxLength: (otlpRaw.contentMaxLength as number | undefined) ?? 2000, forwardAppLogs: otlpRaw.forwardAppLogs !== false, appLogMinSeverity: (otlpRaw.appLogMinSeverity as string | undefined) ?? "debug", redactSecrets: otlpRaw.redactSecrets !== false, ``` ```ts // src/services/lifecycle-telemetry.ts:1460-1463 // Content capture (Part 4A) — gated by captureContent if (captureContent) { if (event.prompt) logAttrs["gen_ai.prompt"] = prepareContent(event.prompt); if (event.systemPrompt) logAttrs["gen_ai.system_prompt"] = prepareContent(event.systemPrompt); ``` ```ts // src/services/lifecycle-telemetry.ts:1681-1685 // Content capture (Part 4B) — completion text on span + log if (captureContent && event.assistantTexts.length > 0) { const completionText = prepareContent(event.assistantTexts.join("\n")); call.span.setAttribute("gen_ai.completion", completionText); outputLogAttrs["gen_ai.completion"] = completionText; } ``` ```ts // src/services/lifecycle-telemetry.ts:1794-1796 // Content capture (Part 4C) if (captureContent && event.content) { spanAttrs["openclaw.content"] = prepareContent(event.content); } ``` ```ts // src/services/lifecycle-telemetry.ts:1870-1872 if (captureContent && event.content) { spanAttrs["openclaw.content"] = prepareContent(event.content); } ``` ### Technical Analysis The plugin uses opt-out defaults for content capture, trace export, log export, and debug-level application-log forwarding. Unless users explicitly disable these options, the plugin exports prompts, system prompts, model completions, and inb ...[truncated 2269 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Change `captureContent` and `forwardAppLogs` defaults to `false`. 2. Require explicit, informed opt-in before exporting prompts, completions, system prompts, or message bodies. 3. Separate operational telemetry from content telemetry so metrics can remain enabled without collecting conversation text. 4. Validate OTLP endpoint URLs and support an administrator-controlled destination allowlist. 5. Reject cleartext HTTP for non-loopback destinations unless an explicit unsafe override is enabled. 6. Provide separate controls for prompts, system prompts, completions, inbound messages, outbound messages, and application logs. 7. Display clear warnings about backend retention, access control, and data residency when content capture is enabled. 8. Apply data minimization, field filtering, and retention limits at both the plugin and collector layers. 9. Add tests proving that no content fields are exported under default configuration. ]]>