other
Warning
- Location
- scripts/guard.sh:186
- Finding
- Undisclosed outbound notifications to a hard-coded Matrix room and account<![CDATA[ ## Vulnerability Details **File Location**: `scripts/guard.sh`, lines 186-232 **Vulnerability Type**: Undisclosed outbound data transmission **Risk Level**: Medium ### Vulnerable Code ```bash "$OPENCLAW_BIN" message send -t "!HwJBqEutNMXtWGuTAa:matrix.local" -m "OpenClaw配置被修改" --account huoxiaoxing >> "$LOG_FILE" 2>&1 "$OPENCLAW_BIN" message send -t "!HwJBqEutNMXtWGuTAa:matrix.local" -m "OpenClaw配置被修改 -> 网关重启成功 -> 开始进行消息验证" --account huoxiaoxing >> "$LOG_FILE" 2>&1 "$OPENCLAW_BIN" message send -t "!HwJBqEutNMXtWGuTAa:matrix.local" -m "OpenClaw配置被修改 -> 网关重启失败 -> 回滚至稳定版本，回归正常监控" --account huoxiaoxing >> "$LOG_FILE" 2>&1 "$OPENCLAW_BIN" message send -t "!HwJBqEutNMXtWGuTAa:matrix.local" -m "OpenClaw配置被修改 -> 网关重启成功 -> 开始进行消息验证 -> 消息验证通过 -> 新配置已备份，回归正常监控" --account huoxiaoxing >> "$LOG_FILE" 2>&1 "$OPENCLAW_BIN" message send -t "!HwJBqEutNMXtWGuTAa:matrix.local" -m "OpenClaw配置被修改 -> 网关重启成功 -> 开始进行消息验证 -> 超时未检测到消息 (${WAIT_TIME}s)，判定为故障配置 -> 回滚至稳定版本，回归正常监控" --account huoxiaoxing >> "$LOG_FILE" 2>&1 "$OPENCLAW_BIN" message send -t "!HwJBqEutNMXtWGuTAa:matrix.local" -m "OpenClaw配置被修改 -> 网关重启成功 -> 开始进行消息验证 -> 验证监控中: 已耗时 ${ELAPSED}s，剩余 ${REMAINING}s..." --account huoxiaoxing >> "$LOG_FILE" 2>&1 ``` ### Technical Analysis The guard sends configuration-change, gateway-status, validation, timeout, and rollback events to the fixed Matrix room `!HwJBqEutNMXtWGuTAa:matrix.local` through the fixed account `huoxiaoxing`. The declared rollback functionality only requires local file monitoring, backup management, gateway control, and session-activity checks. Sending these events to a developer-specific destination is not necessary for those operations. The documentation does not disclose this outbound behavior or require the user to review and replace the destination. No configuration contents, credentials, or private keys are visibly included in these messages. Nevertheless, the messages disclose operational metadata, including configuration-change timing, gate ...[truncated 1512 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all outbound notifications from the default execution path. 2. Make notifications explicitly opt-in, for example: ```bash NOTIFICATIONS_ENABLED="${NOTIFICATIONS_ENABLED:-false}" NOTIFY_TARGET="${NOTIFY_TARGET:-}" NOTIFY_ACCOUNT="${NOTIFY_ACCOUNT:-}" ``` 3. Send a message only when notifications are enabled and both destination settings were explicitly supplied by the user. 4. Reject placeholder, empty, or developer-specific destinations during startup. 5. Document: - That network messages will be sent - Every event that triggers a message - The information included in each message - The account and destination used 6. Avoid including configuration contents, paths, credentials, tokens, command output, or other sensitive data in notifications. 7. Consider using local logging or journald as the default notification mechanism. ]]>