T09 · Insecure Skill Coding Practices
- Location
SKILL.md:22- Finding
Unauthenticated Publication and Indefinite Retention of Conversation-Derived Documents
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 22-45 and 57-64
Vulnerability Type: Public information exposure and insecure data retention
Risk Level: MediumVulnerable Code
markdown ### 1. 整理文档 - 根据对话内容整理解决方案 - 使用 Markdown 格式 - 包含：问题背景、解决步骤、配置示例、常见问题等 - 保存到 `/root/.openclaw/workspace/docs/` 目录 - 文件命名：`<主题>-guide.md` 或 `<主题>.md` ### 2. 部署到 Web - 复制文件到 nginx web 目录：`/www/wwwroot/ucloud.demo.binyuli.top/` - 用户的域名：`ucloud.demo.binyuli.top`（已配置 HTTPS） - 下载链接格式：`https://ucloud.demo.binyuli.top/<文件名>` ### 3. 告知用户 - 提供下载链接 - **必须提醒用户：下载完告诉我要清理文件** 示例回复： > 文档准备好了！ > > **下载链接：** https://ucloud.demo.binyuli.top/xxx-guide.md > > 下载完告诉我，我帮你清理文件。 ### 4. 清理文件 用户确认下载完成后： - 删除 `/www/wwwroot/ucloud.demo.binyuli.top/` 下的临时文档 - 保留 `/root/.openclaw/workspace/docs/` 下的原始文档（作为归档） ## 相关配置 - Web 根目录：`/www/wwwroot/ucloud.demo.binyuli.top/` - 文档归档目录：`/root/.openclaw/workspace/docs/` - 用户域名：`ucloud.demo.binyuli.top`（HTTPS） ## 注意事项 - 文件名使用英文，避免中文和空格 - 使用 kebab-case 命名（如 `whatsapp-setup-guide.md`） - 清理时只删 web 目录的文件，保留归档Technical Analysis
The skill directs the agent to extract material from a conversation, save it under a privileged local path, and copy it into an nginx document root. The resulting URL appears to be directly accessible over HTTPS, but the workflow specifies no authentication, authorization, expiring token, randomized object identifier, or access-control check.
HTTPS only protects data while it is transmitted; it does not prevent an unauthorized party from requesting the published URL. The required descriptive, kebab-case filenames may also make document paths easier to guess. No procedure is defined for detecting or redacting credentials, API keys, personal information, internal hostnames, proprietary configuration, or other sensitive conversation content before publication.
Public cleanup is manual and d ...[truncated 2093 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit user confirmation immediately before publishing a document to any externally reachable location.
- Scan generated documents for secrets, access tokens, passwords, private keys, personal data, internal addresses, and other sensitive information. Require redaction or an explicit override when potential sensitive content is found.
- Replace direct public web-root publication with an authenticated download service.
- Use cryptographically random, unguessable identifiers rather than descriptive filenames in public URLs.
- Issue short-lived signed download links and enforce expiration on the server.
- Automatically delete published files after a short time-to-live, regardless of whether the user returns to confirm the download.
- Disable directory indexing and configure appropriate cache-control and search-engine exclusion headers. These measures are defense in depth and must not replace authentication.
- Define an archive retention policy. Obtain user consent before archival, delete records after the retention period, and provide a deletion mechanism.
- Protect archived documents with restrictive filesystem permissions and encryption at rest. Avoid storing them beneath
/rootunless elevated access is necessary and justified. - Record publication and deletion events without logging document contents, credentials, or signed download tokens.