T09 · Insecure Skill Coding Practices
- Location
scripts/guardian-startup.sh:121- Finding
Workspace Memory Files May Be Exposed to Other Local Users
- Content
View full analysis
Vulnerability Details
File Location:
scripts/guardian-startup.sh, lines 121-126
Vulnerability Type: Insecure file permissions and unsafe filename iteration
Risk Level: MediumVulnerable Code
bash if [ -d "$WORKSPACE" ]; then # Garantir que arquivos do workspace são legíveis for f in $(find "$WORKSPACE" -name "*.md" -not -readable 2>/dev/null); do chmod 644 "$f" echo "✅ Corrigido permissão: $f" FIXED=$((FIXED + 1)) done fiTechnical Analysis
The startup script recursively searches the workspace for Markdown files that are not readable by the account running the script and changes their mode to
0644. This grants read access to the owner, group members, and every other local user.Workspace Markdown files include
MEMORY.md, daily journals, and potentially other agent-generated records. Such files may contain private conversations, operational notes, customer data, credentials, or other sensitive information. Making them world-readable violates least privilege and may expose their contents to unrelated local accounts or compromised low-privilege processes.The loop also uses unquoted command substitution:
bash for f in $(find ...); doShell word splitting and pathname expansion are therefore applied to
findoutput. Paths containing whitespace, newline characters, or glob metacharacters may be split or expanded into unintended arguments. Although"$f"is quoted later, corruption has already occurred while assigning loop values.Attack Path
- A Markdown file containing sensitive workspace or agent memory data exists under
/data/.openclaw/workspace. - The file is not readable by the account executing the guardian script, such as because it has restrictive permissions or mismatched ownership.
- The guardian runs automatically at startup or is invoked during a health check.
- The recursive
findoperation selects the sensitive file. - The script executes
chmod 644, granting every lo ...[truncated 952 chars]
- A Markdown file containing sensitive workspace or agent memory data exists under
- Remediation
View remediation
Remediation Suggestions
Preserve least privilege by granting access only to the service owner. For sensitive workspace records, use mode
0600rather than0644. Process filenames with a null-delimited loop to avoid word splitting and glob expansion:bash find "$WORKSPACE" -type f -name '*.md' -not -readable -print0 | while IFS= read -r -d '' f; do chmod 600 -- "$f" echo "Corrected permissions: $f" doneAdditional hardening should include:
- Verify that each file is owned by the expected service account before changing its permissions.
- Correct unexpected ownership explicitly and safely rather than compensating by granting global read access.
- Restrict permission repair to an allowlist of files managed by this skill, such as
MEMORY.mdand daily journal files. - Ensure workspace directories use restrictive modes, such as
0700, where operationally compatible. - Avoid following symbolic links and confirm that each selected item is a regular file within the canonical workspace path.
- Add tests covering filenames containing spaces, newlines, wildcard characters, and leading hyphens.
- Review previously processed workspace files and remove unintended group or world access, for example by applying an appropriately scoped
chmod go-rwx.