T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/clawlens.py:828
- Finding
- External Transmission of Sensitive Conversation Records Without Local Redaction<![CDATA[ ## Vulnerability Details **File Location**: `scripts/clawlens.py:362-371`, `scripts/clawlens.py:556-610`, `scripts/clawlens.py:735-750`, `scripts/clawlens.py:828-832` **Vulnerability Type**: Sensitive-data disclosure to an external LLM provider **Risk Level**: High ### Vulnerable Code ```python def parse_jsonl(filepath: Path) -> list[dict]: """Read a JSONL file, skip malformed lines.""" entries: list[dict] = [] try: with open(filepath, "r", encoding="utf-8") as f: for line_num, line in enumerate(f, 1): line = line.strip() if not line: continue try: entries.append(json.loads(line)) except json.JSONDecodeError: log(f" Skipping malformed line {line_num} in {filepath.name}") ``` ```python def collect_sessions(agent_id: str, days: int, max_sessions: int) -> list[SessionMeta]: """Stage 1: Scan session files and extract metadata.""" base_dir = Path.home() / ".openclaw" / "agents" / agent_id / "sessions" ``` ```python async def llm_call(prompt: str, model: str, max_tokens: int = 4096, retries: int = 3) -> str: """Make an LLM call via litellm with retry.""" kwargs: dict[str, Any] = dict( model=model, messages=[{"role": "user", "content": prompt}], max_tokens=max_tokens, temperature=0.3, ) if _model_api_base: kwargs["api_base"] = _model_api_base if _model_api_key: kwargs["api_key"] = _model_api_key for attempt in range(retries + 1): try: response = await litellm.acompletion(**kwargs) ``` ```python prompt = FACET_EXTRACTION_PROMPT.replace("{transcript}", transcript) try: raw = await llm_call(prompt, model, max_tokens=2048) ``` ### Technical Analysis The skill reads OpenClaw session JSONL files and constructs transcript text containing user messages, assistant messages, tool calls, and excerpts fro ...[truncated 1923 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit per-run confirmation before transmitting conversation data, including the provider name, destination hostname, session count, and data categories. 2. Implement local redaction before prompt construction. At minimum, detect and remove: - API keys and bearer tokens - OAuth tokens - Private keys and certificates - Passwords and connection strings - Session cookies - Common personal identifiers 3. Exclude tool-result content by default. Provide an explicit option to include it when necessary. 4. Prefer local extraction of metadata and local transcript summarization so that only minimally necessary aggregates leave the device. 5. Add a local-only mode that performs statistical analysis without any external LLM calls. 6. Present a preview of the exact redacted payload or a representative sample before transmission. 7. Document provider retention and privacy implications and allow users to select providers with suitable data-processing guarantees. 8. Apply data minimization at the field level rather than relying only on a character-count limit. ]]>