other
- Location
reference/reference.md:5- Finding
Overbroad Retrieval of Conversation History and Existing Skills
- Content
View full analysis
Vulnerability Details
File Location:
reference/reference.md:5-13; corroborating instruction atSKILL.md:73
Vulnerability Type: Unbounded sensitive context collection
Risk Level: MediumVulnerable Content
English translation of the relevant Markdown instructions from
reference/reference.md:5-13:markdown ## 1. Automatic Context Retrieval Strategy ### 1.1 Retrieval Priority 1. Recent conversations concerning the same topic, matched by keyword. 2. Files related to the current task and existing skill drafts. 3. Similar Trigger / Procedure / Example content from historical skills.Corroborating instruction from
SKILL.md:73:markdown 1. Extract the workflow from context, either manually supplied or automatically retrieved.Technical Analysis
The skill authorizes automatic retrieval from recent conversations, project files, existing drafts, and historical skills. It does not require explicit user approval before retrieval, define a strict source allowlist, impose a time or directory boundary, or require source review before the collected material is processed.
The documented redaction step only applies while producing the resulting skill. It does not prevent the agent from initially accessing unrelated secrets, private conversations, confidential project material, or instructions embedded in historical skills. Retrieved skill text may also be treated as trusted context rather than untrusted data, allowing irrelevant or adversarial historical content to influence the generated artifact.
Attack Path
- A user invokes the skill and requests automatic context retrieval for a broad topic.
- The agent searches recent conversations, current project files, existing drafts, and historical skills using keyword similarity.
- The search collects material outside the minimum scope required for the task, potentially including private or confidential content.
- A historical ...[truncated 1109 chars]
- Remediation
View remediation
Remediation Suggestions
- Default to context explicitly supplied in the current request rather than automatically searching historical sources.
- Obtain explicit user approval before accessing conversation history, historical skills, or project files.
- Require concrete retrieval boundaries, including an approved time range, source list, directory allowlist, and topic definition.
- Exclude credentials, tokens, personal data, private conversations, and unrelated project files before content reaches the synthesis stage.
- Treat all retrieved text as untrusted data. Do not execute or follow instructions found inside conversations, files, examples, or historical skills.
- Present the proposed source list and extracted facts to the user for confirmation before generating or persisting a skill.
- Apply data-minimization controls and retain only information necessary to describe the reusable workflow.
- Run a final secret and sensitive-data scan before writing to
~/.openclaw/skills/. - Require confirmation before overwriting an existing skill or persisting content derived from historical sources.