T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:50
- Finding
- Overprivileged Automatic Injection of Sensitive Memory and Call Data<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 50-64 and 182-196 **Vulnerability Type**: Excessive access to persistent user context and disclosure to an external LLM **Risk Level**: High ### Vulnerable Documentation ```markdown Not needed for this skill — the bridge bypasses OpenClaw and calls Claude directly. This gives you more control over memory injection and cost tracking. ### 2. Create the Bridge Server The bridge is a FastAPI server that: - Accepts OpenAI-compatible `/v1/chat/completions` requests from ElevenLabs - Injects memory context (MEMORY.md, USER.md, live data) - Calls Anthropic Claude API - Streams responses back in OpenAI format - Logs costs and transcripts **Key files:** - `server.py` — FastAPI app with /v1/chat/completions endpoint - `fred_prompt.py` — System prompt builder (loads memory files) - `.env` — Secrets (API keys, tokens, whitelist) - `contacts.json` — Caller whitelist for screening ``` ```markdown ## Memory Injection The bridge auto-loads context before each call: **Files read:** - `MEMORY.md` — Long-term facts about user, projects, preferences - `USER.md` — User profile (name, location, timezone) - Recent call transcripts (cross-call memory) **Live data injection:** - Current time/date - Weather (optional, via API) - Calendar events (optional, via gog CLI) All injected into the system prompt before Claude sees the conversation. ``` ### Technical Analysis The documented bridge bypasses OpenClaw and automatically loads broad persistent context before each call. That context includes long-term memory, the user profile, previous call transcripts, and potentially calendar information. It is then inserted into the system prompt and transmitted to Anthropic through the custom bridge. This design violates least-privilege and data-minimization principles. A routine phone conversation does not inherently require access to every fact in `MEMORY.md`, the complete user profile, or unrelated prior transcri ...[truncated 2505 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Remove unconditional memory loading** - Do not inject complete memory files or transcript history into every call. - Default to an empty or minimal context for new and unknown callers. 2. **Authenticate before retrieving sensitive context** - Require a strong authentication step before reading private data. - Do not rely exclusively on caller ID or a reusable spoken PIN. - Use short-lived challenges, account-linked verification, and replay protection for sensitive operations. 3. **Apply caller-specific authorization** - Associate each verified caller with explicit data scopes. - Distinguish general conversation, profile access, transcript access, calendar access, and action-taking permissions. - Deny access unless a scope is explicitly granted. 4. **Use task-specific retrieval** - Retrieve only the minimum fields needed for the caller's current request. - Use structured records with access-control metadata rather than inserting complete Markdown files. - Do not provide prior transcripts unless the caller is authorized for the particular conversation. 5. **Filter and redact sensitive information** - Exclude credentials, tokens, private keys, financial details, medical information, and unrelated third-party data. - Apply deterministic redaction before content is sent to ElevenLabs or Anthropic. - Prevent secrets in `.env` or adjacent files from ever entering prompts or logs. 6. **Separate untrusted input from privileged context** - Treat caller speech, transcript content, and stored call summaries as untrusted. - Prevent stored or spoken instructions from overriding authorization rules. - Enforce access decisions in application code rather than relying on model prompts. 7. **Protect transcripts and logs** - Encrypt stored transcripts and cost records. - Establish retention and deletion policies. - Restrict file permissions and avoid logging authorization tokens ...[truncated 407 chars]