T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:55
- Finding
- Mandatory Broad Access to Persistent Session History and Private Memory<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55-104 **Vulnerability Type**: Excessive access to persistent memory and unrelated historical data **Risk Level**: High ### Vulnerable Code ```markdown | Vector memory DB | OpenClaw feature | Semantic search across session history, notes, and memory files | Enable in `openclaw.json` (`memory.enabled: true`) | **Before starting any skill design or update session, verify both are available:** ```bash # Check vector memory (should return results, not empty) # Use the memory_search tool with a known topic from recent sessions ``` ## Memory Search Protocol (MANDATORY) Before searching files manually, always query the vector memory database first. It indexes session history, Obsidian notes, and memory files — and finds cross-document connections that manual search misses. **How to query correctly:** ``` memory_search("your query here", maxResults=5) ``` **Critical rule: try multiple queries before giving up.** ``` ### Technical Analysis The Skill makes persistent-memory access a mandatory prerequisite for design and update operations. That database may contain unrelated session history, private notes, configuration details, organizational information, and prior user data. The core declared operation—designing, reviewing, and testing a target Skill—normally requires only the target artifact directory and requirements supplied for the current task. Searching persistent memory by default violates least privilege because it broadens the readable data scope without demonstrating that the additional information is necessary. Repeatedly rephrasing failed searches further increases the chance that semantically related but unrelated confidential records will be retrieved. Retrieved records may subsequently be incorporated into Designer prompts, subagent context, generated documentation, review reports, or external DeepWiki questions. ### Attack Path 1. A user requests creation, maintenance, or ...[truncated 1134 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove persistent-memory access as a mandatory dependency. 2. Default to user-provided requirements and files inside the explicitly selected target directory. 3. Require explicit user authorization before searching session history, notes, or memory. 4. Show the intended search scope and query to the user before execution. 5. Restrict searches to project identifiers or memory namespaces selected by the user. 6. Do not automatically retry with broader or semantically different queries. 7. Treat retrieved memory as sensitive and prevent it from being included in external queries, Git commits, generated public documentation, or subagent prompts unless separately approved. 8. Add provenance labels to retrieved records so reviewers can detect when generated content came from persistent memory. ]]>