T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:19- Finding
Unscoped Access to Shared Inbound Attachments
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 19-23, 31-35, and 58-65
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: MediumVulnerable Code
markdown ### 1. 检测最新文件 当没有明确文件名时，扫描 inbound 目录获取最新文件： ```bash ls -lt ~/.openclaw/media/inbound/ | head -20text ```markdown ### 3. 文件内容读取 根据文件类型选择读取方式： - 文本文件：直接 cat - CSV/Excel：转换为表格 - 图片：使用 image tool 识别 - Word/PDF：使用 markitdown 或 minimax-ocrmarkdown ## 触发场景 - 用户说"获取文件" - 用户说"发送附件" - 用户说"看看有什么文件" - 用户上传文件后没有反应 - 用户提到某个具体项目但没有附文件Technical Analysis
The skill directs the agent to enumerate
~/.openclaw/media/inbound/whenever the user does not provide a specific filename. It may then read selected files directly or process them through document, spreadsheet, image, or OCR tools.The trigger conditions are broad enough to activate when no attachment was supplied, including when a user merely asks what files exist or mentions a project without attaching a file. No instruction binds candidate files to the current user, message, conversation, or trusted attachment identifier. There is also no authorization check or confirmation step before file content is accessed.
If the inbound directory contains attachments from multiple conversations, users, or projects, selecting files according to recency rather than ownership can cross a confidentiality boundary. This violates least privilege because fulfilling a request concerning one attachment does not require access to unrelated inbound files.
Attack Path
- A user asks the agent to “get a file,” “show available files,” or refers to a project without supplying an attachment.
- The skill activates and runs:
bash ls -lt ~/.openclaw/media/inbound/ | head -20 - The directory listing reveals recent filenames and associated metadata from the shared inbound directory.
- In the absence of a conv ...[truncated 1378 chars]
- Remediation
View remediation
Remediation Suggestions
- Require a trusted attachment identifier tied to the current message or conversation. Do not select files based only on recency.
- Restrict file access to a per-user or per-conversation directory rather than the shared inbound directory.
- If no attachment is associated with the current request, ask the user to upload or explicitly select a file instead of enumerating directory contents.
- Validate that the resolved file path belongs to the authorized conversation scope before listing, reading, converting, copying, or returning its contents.
- Avoid exposing raw directory listings. If selection is unavoidable, show only sanitized metadata for files already proven to belong to the current conversation.
- Require explicit user confirmation before opening a file or copying it into
companywork/. - Enforce an allowlist of archival destinations, restrictive filesystem permissions, retention limits, and audit logging for file reads and copies.
- Treat inbound documents as untrusted content when using converters or OCR tools. Use sandboxing, resource limits, patched parsers, and non-executable processing modes.
- Define deterministic behavior for ambiguous requests: refuse access when ownership or conversation association cannot be established.