T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:158- Finding
Shared Workspace and Memory Pool Violate Agent Isolation Boundaries
- Content
View full analysis
- Remediation
View remediation
Security audit
OpenClaw Multi-Agent System
Security checks for vulnerabilities and agentic risk
Overview
This Markdown setup skill is not malicious, but it needs review because it configures Telegram bots and agents to share broad group-message, workspace, and memory access without enough privacy and credential-handling guidance.
Install only if you intentionally want all configured agents to share workspace files and a MemOS memory pool, and if Telegram group participants understand that privacy-disabled bots may see broader group messages. Use tightly scoped allowlists, avoid forwarding real group messages to third-party bots, keep bot tokens out of shared chats/files/logs, rotate any exposed token, and consider separate workspaces or memory namespaces for agents handling sensitive content.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)
other
Warning
- Location
SKILL.md:66- Finding
Telegram Privacy Is Disabled and Group Messages May Be Disclosed to a Third-Party Bot
- Content
View full analysis
/setprivacy -> Disable ``` ```markdown - Forward a group message to [@raw_data_bot](https://t.me/raw_data_bot) - Or inspect the `chat.id` field of a group message ``` The checklist repeats that subordinate bots must have `/setprivacy` set to `Disable`. ### Technical Analysis Disabling Telegram Bot Privacy Mode allows a bot in a group to receive a broader set of group messages instead of limiting routine processing to commands, replies, and directly relevant interactions. Applying this setting to every subordinate bot expands the number of bot identities and agent pipelines that can observe group content. The example configuration enables a partial mitigation by requiring mentions for subordinate accounts, but `requireMention` controls application response behavior and should not be treated as equivalent to Telegram-side message-delivery isolation. The setup guide mandates disabling the platform privacy control without documenting participant consent, retention policy, bot compromise risk, or whether every specialized agent genuinely requires access to all group traffic. The guide also recommends forwarding a group message to `@raw_data_bot`, an external Telegram bot, to discover the group identifier. That action discloses the forwarded message and associated Telegram metadata to a third party outside this project. The project provides no source, ownership, privacy policy, or data-handling guarantees for that service. ### Attack Path 1. An administrator follows the setup guide and disables Privacy Mode for all subordinate bots. 2. The bots are added to a group whose participants may assume that messages not directed to a bot remain outside its processing scope. 3. Group mes ...[truncated 1241 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Rogue AgentSelf-Modification, Session Persistence
- MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
Findings (11)
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Tp2
High
- Category
- MCP Tool Poisoning
- Confidence
- 85% confidence
- Finding
Mixing characters from multiple Unicode scripts in a single identifier is a common technique to create visually ambiguous tool names.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The README states that all agents share the same workspace, memory pool, shared context, and access to USER.md, creating broad cross-agent data exposure by design. Without warnings, isolation boundaries, or access-control guidance, a weaker or misconfigured agent can read or influence data intended for another agent, increasing confidentiality and integrity risks in collaborative group deployments.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The README explicitly instructs operators to disable Telegram bot privacy mode, which causes bots to receive a much broader set of group messages rather than only messages directed at them. In a multi-agent setup with shared workspace and shared memory, this increases the chance that unrelated user conversations, sensitive group content, or personal data are collected and propagated across agents without informed consent or minimization.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The skill instructs users to provide sensitive Telegram artifacts including bot tokens, group IDs, and user IDs, but does not include handling guidance such as masking, secure entry, non-logging, or post-use rotation. Because bot tokens grant control over Telegram bots, accidental disclosure through chat history, logs, shared workspaces, or memory systems could lead to account takeover or unauthorized bot operation.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The instructions require disabling Telegram bot privacy mode for each sub-bot without clearly warning that this expands the bot's visibility to group messages and may expose conversations to all configured agents sharing the same workspace and memory pool. In this skill's context, the risk is elevated because it explicitly sets up multiple agents with shared workspace and shared MemOS memory, increasing the chance of over-collection, retention, and unintended cross-agent disclosure of group content.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 83% confidence
- Finding
The skill directs creation of persistent shared directories for workspace and per-agent state, which can retain conversation artifacts, shared context, and potentially sensitive operational data across sessions. In this multi-agent design, persistence is more dangerous than usual because all agents share the same workspace and memory context, increasing the blast radius of accidental data exposure, unauthorized reads between agents, or long-term retention of sensitive information.
- Content
Step 2：创建目录结构
bash # 共享上下文目录 mkdir -p ~/.openclaw/workspace/shared-context # 每个子 Agent 的专属目录 mkdir -p ~/.openclaw/workspace/agents/{agent_id}
Static analysis
No suspicious patterns detected.