T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/note.py:11- Finding
Undocumented Cross-Project File Read and Write Access
- Content
View full analysis
Vulnerability Details
File Location:
scripts/note.py, lines 11-28
Vulnerability Type: Unauthorized access to files outside the Skill workspace
Risk Level: MediumEvidence
python NOTE_TAKER_DIR = Path("/Users/guohongbin/mcp-note-taker") NOTES_FILE = NOTE_TAKER_DIR / "notes.txt" def add_note(content): timestamp = datetime.datetime.now().strftime("%Y-%m-%d %H:%M:%S") entry = f"\n[{timestamp}] {content}" with open(NOTES_FILE, "a") as f: f.write(entry) print(f"✅ Note saved to {NOTES_FILE}") def list_notes(last_n=10): if not NOTES_FILE.exists(): print("No notes found.") return with open(NOTES_FILE, "r") as f: lines = f.readlines()The command dispatch that exposes these operations appears at lines 34-48:
python if __name__ == "__main__": if len(sys.argv) < 2: print("Usage: note <text> | note --list") sys.exit(1) cmd = sys.argv[1] if cmd == "--list": list_notes() else: # Join all arguments as the note content content = " ".join(sys.argv[1:]) add_note(content)Technical Analysis
The bundled utility uses an absolute, author-specific path to access another project's data. That location is outside both the Skill package and the expected OpenClaw workspace. This violates least privilege because note storage access is unrelated to the declared memory consolidation and sleep-cycle functionality.
Running the script with
--listreads the external note file and prints its contents. Running it with any other arguments appends those arguments to the same file. There is no path validation, workspace-boundary check, user confirmation, or documented configuration governing this access.The issue does not elevate operating-system privileges: all access remains limited to files available under the invoking user's pe ...[truncated 1248 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
scripts/note.pyfrom the package if note-taking is not part of the declared Skill functionality. - If integration is required, replace the hard-coded path with an explicit, user-provided configuration value.
- Default storage to a dedicated directory within the approved OpenClaw workspace.
- Resolve and normalize the configured path, then verify that it remains inside an approved storage root.
- Require explicit user confirmation before reading from or writing to storage owned by another application.
- Document the integration, accessed files, supported operations, and associated privacy implications.
- Apply restrictive file permissions and avoid printing note contents unless disclosure was explicitly requested and authorized.
- Add error handling for missing directories, permission failures, symbolic links, and unexpected file types.
- Remove