T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/oracle_engine.py:5
- Finding
- Cross-Skill Configuration Access Violates Package Isolation## Vulnerability Details **File Location**: `scripts/oracle_engine.py`, lines 5-9 **Vulnerability Type**: Unauthorized cross-skill file access **Risk Level**: Medium ### Vulnerable Code ```python FORUMS_PATH = "/root/.openclaw/workspace/skills/global-forum-oracle/forums.json" def load_forums(): with open(FORUMS_PATH, 'r') as f: return json.load(f) ``` ### Technical Analysis The script reads configuration from the directory of a separate skill, `global-forum-oracle`, even though this project contains its own `forums.json`. This breaks package isolation and violates the principle of least privilege. The process can read the neighboring file whenever its operating-system account has permission to do so. The JSON content is subsequently trusted as a mapping of countries to domain lists. There is no verification that the resolved file belongs to the current package and no schema validation before its contents are used. This finding does not establish an operating-system privilege escalation: the script remains limited to the permissions of its existing process account. However, it crosses an application-level skill boundary unrelated to the package's legitimate configuration needs. ### Attack Path 1. An attacker or compromised skill with write access to the neighboring `global-forum-oracle` directory modifies its `forums.json`. 2. A user invokes `scripts/oracle_engine.py` with a research query. 3. `load_forums()` reads the neighboring, attacker-influenced file instead of this package's bundled `forums.json`. 4. The attacker-controlled domain entries are incorporated into the generated search-task output. 5. If another component later executes those search tasks, it may be directed toward attacker-selected domains. The first step requires pre-existing write access to the neighboring configuration. This code does not itself grant that access. ### Impact Assessment The immediate impact is unauthorized ...[truncated 339 chars]
- Remediation
- ## Remediation Suggestions - Resolve the bundled configuration relative to the current script rather than another skill: ```python from pathlib import Path FORUMS_PATH = ( Path(__file__).resolve().parent.parent / "forums.json" ) ``` - Resolve the resulting path and verify that it remains under the expected package root before opening it. - Validate the JSON schema, requiring a mapping whose values are lists of valid domain names. - Reject malformed domains, URLs, control characters, and unexpected JSON fields. - Run the skill under a dedicated, non-root account that cannot read or modify unrelated skill directories. - If cross-skill sharing is genuinely required, use an explicit, permission-controlled shared-data interface rather than directly reading another package's files.