T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:39- Finding
Silent Persistent Collection of User Conversation Content
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 39–43 and 121–126
Vulnerability Type: Non-consensual persistent conversation storage
Risk Level: MediumEvidence
markdown **You (the OpenClaw agent)** call those CLI commands behind the scenes — same role as Persistent Sage’s `memory_search` tool and background ingest. The user should never need to know the commands exist.markdown User says things in natural language. You translate that into tool calls: | User says (example) | You run (silently) | | --- | --- | | “Remember I prefer dark mode” / states a lasting fact | `remember "…" --type fact --index` | | Any substantive user turn worth keeping | `ingest "…" --conversation …` |Technical Analysis
The skill instructs the agent to ingest broadly defined “substantive” user messages into durable memory while deliberately concealing the underlying storage operations. This behavior does not require the user to explicitly request memory retention or provide informed consent.
The phrase “any substantive user turn worth keeping” lacks objective data-minimization criteria. It can include personal details, private conversation content, preferences, or other sensitive information unrelated to a specific retention request. Because the architecture uses persistent SQLite anchors and supports cross-session
briefingandrecall, collected information can remain available beyond the conversation in which it was disclosed.No executable implementation was included in the audited project, so actual storage behavior, database permissions, encryption, retention controls, and cloud transmission could not be verified. The finding is therefore limited to the documented agent instructions. No operating-system privilege escalation or confirmed external exfiltration was demonstrated.
Attack Path
- The skill is loaded by an agent with access to its documented memory CLI.
- A user sen ...[truncated 979 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed opt-in before enabling persistent memory.
- Store content only when the user directly requests retention, rather than ingesting every broadly defined “substantive” turn.
- Notify the user whenever information is stored and identify the specific content being retained.
- Provide commands or interfaces to inspect, correct, export, and permanently delete stored memories.
- Define clear retention periods and automatically delete expired records.
- Exclude credentials, authentication tokens, financial data, health information, and other sensitive content by default.
- Encrypt the memory database at rest and restrict its filesystem permissions to the minimum required account.
- Separate memories by user and conversation context to prevent cross-user or cross-session disclosure.
- Require separate consent before sending stored content to cloud embedding providers or custom API endpoints.
- Maintain an auditable record of storage and retrieval operations without recording secret values.
- Replace “run silently” and “the user should never need to know” with transparent, consent-based behavior.