T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:147- Finding
Explicit Bypass of Workspace Isolation Through Unrestricted Shell Commands
- Content
View full analysis
~/.openclaw/workspace-buyer/tasks/pending/003-xxx.md << 'EOF' # Task title Priority: Medium Description: ... EOF ``` Related instructions explicitly recommend using shell commands to bypass tool restrictions: ```markdown | Scenario | Solution | |----------|----------| | Foreman writes to another agent's workspace | Use bash `cat > file` instead of the Write tool | | Agent needs to read another workspace | Use bash `cat file` or `ls dir` | ``` ### Technical Analysis The skill recognizes that OpenClaw's sandboxed Read and Write tools enforce workspace boundaries through canonical path validation. It then directs agents to circumvent that control by invoking unrestricted shell commands. This changes the workspace boundary from an enforced security control into a convention. An agent with shell access can read or modify files in any location available to the operating-system account, not merely the intended task queue. The provided command demonstrates writes into another agent's workspace, while the related guidance also recommends cross-workspace reads. Although cross-agent task dispatch is part of the stated architecture, unrestricted shell access is broader than the legitimate requirement. It does not constrain access to a dedicated queue, validate task contents, authenticate task producers, or prevent access to other files in subordinate workspaces. ### Attack Path 1. An attacker sends malicious or prompt-injection content through a channel processed by the main agent, such as a Feishu ...[truncated 1657 chars]- Remediation
View remediation