T05 · Unauthorized Access and Privilege Escalation
- Location
agentes/agente-analista.md:200- Finding
Excessive Unattended Command-Execution and Filesystem Permissions
- Content
View full analysis
Vulnerability Details
File Location:
agentes/agente-analista.md:200-207
Vulnerability Type: Excessive agent permissions and unattended execution
Risk Level: MediumVulnerable Configuration
json { "agents": { "analista": { "model": "claude-3-haiku-20240307", "systemPrompt": "Eres analista especializado en medir impacto de IA...", "tools": ["memory_search", "exec", "write"], "workspace": "/skills/consultoria-ia", "schedule": "0 9 * * 1" # Lunes 9:00 AM } } }The general requirements also request broad permissions in
SKILL.md:56-59:markdown ## Requisitos - OpenClaw 2026.4.0 o superior - Acceso a modelos: Claude Sonnet, GPT-4, Claude Haiku - Permisos: filesystem, memory, tools básicosTechnical Analysis
The recommended analyst configuration violates the principle of least privilege. Its declared responsibilities are metric analysis, ROI calculation, and report generation, but it is granted:
exec, which can invoke local commands with the privileges of the OpenClaw process.write, which can modify files accessible to that process.memory_search, which introduces potentially untrusted persistent content into the agent context.- A weekly schedule, which permits the agent to operate without contemporaneous user review.
The configuration does not define a command allowlist, a report-only destination, filesystem confinement, input trust boundaries, or mandatory approval before side effects. Consequently, adversarial instructions embedded in client metrics, project documents, integration responses, or retrieved memory could influence the scheduled model into invoking privileged tools.
No malicious command or active exploitation logic is shipped in the project. This finding concerns an unsafe recommended privilege boundary that creates an exploitable path when deployed.
Attack Path
- An attacker places adversarial instructions in content that the analyst is expe ...[truncated 1289 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
execfrom the analyst agent because ROI analysis and report generation do not inherently require shell access. - Replace unrestricted
writewith a narrowly scoped report-output capability restricted to a dedicated directory. - Apply operating-system and OpenClaw sandboxing so the agent cannot access unrelated project, user, configuration, or credential files.
- Disable scheduled execution by default, or require explicit approval before processing newly retrieved content.
- Require human confirmation for every command execution, file overwrite, deletion, outbound message, or other side effect.
- Allowlist approved metric sources, file types, output paths, and operations.
- Treat client data, monitoring output, integration responses, and retrieved memory as untrusted data rather than instructions.
- Add explicit prompt-injection defenses that prohibit tool use based solely on instructions found in analyzed content.
- Log all tool invocations and alert operators when scheduled tasks attempt a side effect.
- If command execution is indispensable, expose narrowly defined helper operations instead of a general-purpose
exectool and run them in an isolated, non-privileged environment.
- Remove