T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/transcribe_telegram_ogg.sh:4
- Finding
- Unscoped Audio Fallback May Transcribe Another User's Voice Message## Vulnerability Details **File Location**: `scripts/transcribe_telegram_ogg.sh`, lines 4–7; behavior is also recommended in `SKILL.md`, lines 42–47 **Vulnerability Type**: Cross-user data exposure caused by insecure file selection **Risk Level**: Medium ### Vulnerable Code ```bash OGG_PATH="${1:-}" if [[ -z "${OGG_PATH}" ]]; then OGG_PATH="$(ls -t "${HOME}/.openclaw/media/inbound"/*.ogg 2>/dev/null | head -n 1 || true)" fi ``` The corresponding skill instructions state: ```markdown Recommended approach: 1) If the inbound message context includes an attachment path, use it. 2) Otherwise, take the most recent `*.ogg` from `~/.openclaw/media/inbound/`. ``` ### Technical Analysis When no explicit attachment path is supplied, the script selects the most recently modified OGG file from a shared inbound-media directory. It does not verify that the selected file belongs to the current Telegram sender, chat, message, or invocation. File recency is not an authorization or ownership boundary. In concurrent or multi-user deployments, the newest file can belong to an unrelated conversation. The script will then pass that file to `yap` for transcription: ```bash yap transcribe --locale "${YAP_LOCALE}" "${OGG_PATH}" ``` The resulting transcript may influence or be included in a response sent to the wrong user. The implementation therefore creates a cross-conversation data-isolation flaw even though its shell arguments are quoted and no command injection was identified. ### Attack Path 1. A victim sends a private Telegram voice note, which OpenClaw stores as an OGG file under `~/.openclaw/media/inbound/`. 2. Another user triggers the skill in a conversation where no trusted attachment path is available or passed to the helper. 3. Before the fallback selection occurs, the victim's file is the most recent OGG file in the shared directory. 4. The helper selects the victim's file solely according to modification time. 5. `yap` transcribes the victim's voice note in ...[truncated 835 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the global “most recent OGG” fallback and require an explicit attachment path for every transcription. 2. Obtain the path from trusted Telegram/OpenClaw message metadata and bind it to the current message, chat, and sender. 3. Fail closed when attachment metadata is absent or ambiguous rather than selecting an unrelated file by modification time. 4. Canonicalize the supplied path and verify that it resides within the intended inbound-media directory. 5. Where platform metadata permits, verify that the attachment identifier and file ownership metadata match the active invocation. 6. Prefer per-chat or per-message directories so files from unrelated conversations do not share the same selection namespace. 7. Update `SKILL.md` to remove the recommendation to select the newest shared OGG file. 8. Add concurrency tests covering multiple users uploading voice notes at nearly the same time and confirm that each invocation can process only its associated attachment. A safer minimal behavior would be: ```bash OGG_PATH="${1:-}" if [[ -z "${OGG_PATH}" ]]; then echo "ERROR: an attachment path tied to the current message is required" >&2 exit 2 fi INBOUND_ROOT="${HOME}/.openclaw/media/inbound" CANONICAL_ROOT="$(cd "${INBOUND_ROOT}" && pwd -P)" CANONICAL_FILE="$(cd "$(dirname "${OGG_PATH}")" 2>/dev/null && printf '%s/%s\n' "$(pwd -P)" "$(basename "${OGG_PATH}")")" if [[ ! -f "${CANONICAL_FILE}" || "${CANONICAL_FILE}" != "${CANONICAL_ROOT}/"* ]]; then echo "ERROR: invalid inbound attachment path" >&2 exit 2 fi ``` Path containment validation should supplement—not replace—message-level ownership validation.