T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:33
- Finding
- Main-Agent Credentials Can Be Copied into Newly Created Agents## Vulnerability Details **File Location**: `SKILL.md`, lines 33-36 **Vulnerability Type**: Credential inheritance across agent trust boundaries **Risk Level**: High ### Vulnerable Code Snippet ```markdown In `~/.openclaw/workspace-{agentId}/agent/`, create: | File | Content | |------|---------| | **models.json** | Model configuration copied from the main agent, with the provider modified | | **auth.json** | Authentication configuration: an empty object `{}` or copied from the main agent | ``` ### Technical Analysis The documented workflow explicitly permits copying the main agent's `auth.json` into a newly created agent. Authentication configuration can contain API credentials, provider tokens, session credentials, or references granting access to protected resources. A new agent is a separate execution identity and workspace. Copying credentials from the main agent violates least privilege because the new agent may inherit authority unrelated to its intended task. The procedure does not require credential filtering, scope reduction, rotation, separate service identities, or explicit confirmation before copying authentication material. ### Attack Path 1. An operator creates a new agent using this skill. 2. The operator or automated agent follows the documented option to copy the main agent's `auth.json`. 3. The new workspace receives the main agent's authentication material. 4. A malicious prompt, compromised subagent, or process with access to the new workspace reads or uses those credentials. 5. The attacker accesses provider resources with the main agent's privileges rather than the limited privileges required by the new agent. ### Impact Assessment Exploitation can expose every provider or service represented in the copied authentication file. The resulting privileges depend on the copied credentials, but may include model API use, account-level resource access, unauthorized expenditure, access to protec ...[truncated 197 chars]
- Remediation
- ## Remediation Suggestions - Remove the option to copy the main agent's `auth.json`. - Initialize every new agent with an empty authentication object by default. - Provision a separate service identity and credential set for each agent. - Limit credentials to the exact providers, operations, resources, and duration required. - Require explicit user authorization before migrating any existing credential. - If migration is necessary, use an allowlist to copy only approved non-secret configuration fields. - Store credentials in a secret manager rather than directly in workspace files. - Enforce restrictive filesystem permissions and audit access to authentication material. - Rotate any main-agent credentials that have already been duplicated.