T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:16
- Finding
- Excessive Collection and Aggregation of Sensitive Agent State## Vulnerability Details **File Location**: `SKILL.md`, lines 16-29 **Vulnerability Type**: Excessive access to sensitive workspace data **Risk Level**: Medium ### Evidence ```markdown ## 📋 准备工作 - 确认当前工作区路径（可通过环境变量 `WORKSPACE` 或默认 `~/.openclaw/workspace` 获取）。 - 确保你有读写工作区内文件的权限。 ## 🔍 步骤1：检查自身状态 **目标**：查明当前智能体的状态、工作进度和可用技能。 1. **读取核心文件**： - 使用 `read` 工具读取 `IDENTITY.md`、`SOUL.md`、`USER.md`，了解基本设定。 - 读取 `MEMORY.md` 和今天的日志文件（`memory/YYYY-MM-DD.md`），了解近期活动和长期记忆。 2. **检查技能可用性**： - 调用 `list_skills` 工具获取当前已安装的技能列表（名称+描述）。 - 对比 `TOOLS.md` 中定义的技能，确保没有缺失。 3. **生成状态摘要**： ``` ### Technical Analysis The Skill instructs the agent to locate its workspace and systematically read identity configuration, user information, long-term memory, daily activity logs, tool configuration, and installed Skill metadata. It then directs the agent to aggregate this information into a status report. This access pattern exceeds the minimum information generally required for a routine health check. In particular, `USER.md`, `MEMORY.md`, and daily logs may contain private user context, operational history, or other sensitive data. Tool and Skill enumeration also reveals the agent's available capabilities. The instructions do not define data minimization, field-level access restrictions, redaction, output access controls, or explicit user approval before sensitive files are processed. The Skill does not itself acquire new operating-system privileges, bypass a technical access-control mechanism, or transmit the collected information externally. The risk instead arises from directing an already privileged agent to use its existing file-read capabilities more broadly than necessary. ### Attack Path 1. A user, automation rule, or suggested daily trigger invokes the Skill. 2. The Skill resolves the workspace through `WORKSPACE` or the default `~/.openclaw/workspace` path. 3. The agent reads `IDENTITY.md`, `SOUL.md`, `USER.md`, `M ...[truncated 1063 chars]
- Remediation
- ## Remediation Suggestions 1. Apply least privilege by limiting routine status checks to non-sensitive health indicators and explicitly approved files. 2. Require affirmative user authorization before reading `USER.md`, `MEMORY.md`, or daily activity logs. 3. Read only the fields needed for the report instead of loading entire files. 4. Redact personal information, secrets, credentials, unique identifiers, private conversations, and detailed memory content before generating output. 5. Report counts or high-level status values rather than reproducing raw tasks, memories, or logs. 6. Avoid enumerating tools and installed Skills unless capability inventory is explicitly requested. 7. Add output-handling requirements that prevent sensitive reports from being written to shared locations or retained unnecessarily. 8. If scheduled execution is enabled, require explicit opt-in and provide a clear way to disable it. 9. Define an allowlist of workspace paths and prohibit traversal, symbolic-link following, or reads outside the approved workspace.