T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- package.json:8
- Finding
- Excessive Local Tool Permissions Violate Least Privilege## Vulnerability Details **File Location**: `package.json:8-12` **Vulnerability Type**: Excessive tool permissions **Risk Level**: Medium ```json "skills": { "dependencies": { "tools": ["exec", "read"], "binaries": ["curl"], "envVars": [] } } ``` ### Technical Analysis The skill declares access to both `exec` and `read`, although its documented functionality only requires sending HTTP requests to the MarsBit MCP endpoint using `curl`. No documented workflow requires arbitrary local file-reading capability. The broad `exec` capability also exposes a general command-execution interface rather than a narrowly scoped HTTP client. If the OpenClaw runtime enforces these declarations as available capabilities, the skill receives more authority than is necessary for retrieving news. This violates the principle of least privilege. Untrusted content returned by the remote news service may subsequently be processed by an agent that has access to these capabilities, increasing the consequences of prompt injection or tool-manipulation attacks. ### Attack Path 1. The skill is installed with the declared `exec` and `read` capabilities. 2. The agent retrieves attacker-controlled or compromised content through the remote MCP endpoint. 3. The content contains instructions designed to induce an unintended tool call. 4. The agent invokes `read` to access unrelated local files or uses `exec` to run commands outside the intended `curl` workflow. 5. Data accessible to the OpenClaw process may be disclosed or modified, depending on the command executed and the operating-system permissions of the process. Exploitation depends on the host agent accepting malicious instructions and exposing the declared tools without additional policy enforcement. ### Impact Assessment An attacker could potentially read files accessible to the OpenClaw process or execute arbitrary commands with the privileges of the account runnin ...[truncated 325 chars]
- Remediation
- ## Remediation Suggestions - Remove the unused `read` capability from the skill manifest. - Replace unrestricted `exec` with a dedicated HTTP or MCP capability where the runtime supports one. - Restrict outbound traffic to `https://www.marsbit.co/api/mcp`. - If `exec` is unavoidable, enforce an allowlist that permits only the expected `curl` executable and fixed endpoint. - Prevent remote response content from controlling command names, command-line options, URLs, headers, or shell syntax. - Run the skill under a dedicated low-privilege account with restricted filesystem access and no unnecessary credentials. - Apply agent-level confirmation or policy checks before allowing local file access or commands unrelated to the documented news-retrieval workflow.