T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:22- Finding
Unrestricted Enumeration and Transmission of Local Files
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 22–39
Vulnerability Type: Missing authorization and path-scope controls for local file disclosure
Risk Level: HighRelevant instruction excerpt:
text Files are stored in the following directories: - Main workspace: `~/.openclaw/workspace/` - Company business directory: `~/.openclaw/workspace/memory/companywork/` - Video content: `~/.openclaw/workspace/memory/douyin-videos/` In a response, place a MEDIA instruction on its own line, followed by the local file path. Format: MEDIA: /absolute/path/to/file Examples: MEDIA: ~/.openclaw/workspace/memory/companywork/meeting-notes.md MEDIA: ~/openclaw/workspace/test.pdfRelated file-discovery instructions also appear at
SKILL.md, lines 53–57:bash ls -la ~/.openclaw/workspace/memory/companywork/Technical Analysis
The skill explicitly identifies workspace, persistent memory, and company-business directories, instructs the agent to enumerate their contents, and permits a
MEDIA:directive containing an arbitrary absolute local path. It does not require the agent to:- Verify that the requester owns or is authorized to receive the file.
- Restrict selection to a dedicated export directory.
- Canonicalize the requested path and enforce an allowlist.
- Reject symbolic links that resolve outside an approved directory.
- Detect credentials, secrets, persistent memory, or confidential business data.
- Obtain explicit confirmation before transmitting sensitive material.
Consequently, a requester can prompt the agent to search for and transmit locally readable files unrelated to the requester's legitimate access rights. This breaks least-privilege boundaries at the application level. The reviewed material does not demonstrate elevation of operating-system privileges; exploitation is limited to files already readable by the agent process.
Attack Path
- An atta ...[truncated 1301 chars]
- Remediation
View remediation
Remediation Suggestions
- Restrict file transmission to a dedicated export directory containing only files intentionally staged for sharing.
- Resolve every requested path to its canonical form and verify that it remains beneath the approved directory.
- Reject absolute paths supplied directly by users, parent-directory traversal, device paths, and symbolic links that escape the approved root.
- Require authenticated recipient authorization and verify that the recipient is permitted to access the selected file.
- Present the resolved filename, recipient, sensitivity classification, and destination for explicit confirmation before transmission.
- Deny transmission from memory, credential, configuration, and company-sensitive directories by default.
- Avoid unrestricted directory enumeration. Use a controlled file index filtered according to the requester's access rights.
- Add content and metadata checks for secrets, personal data, credentials, and confidential business information.
- Record auditable events for file selection, authorization, confirmation, and transmission without logging file contents or secrets.
- Ensure the downstream
MEDIA:handler independently enforces the same path and authorization controls rather than trusting skill instructions alone.