T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:11
- Finding
- Excessive Collection of Cross-Agent Conversation History and Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 11–14 and 18–26 **Vulnerability Type**: T05: Unauthorized Access and Privilege Escalation **Risk Level**: Medium **Relevant snippet**: ```markdown ## 固定输入 1. 全量会话历史：`~/.openclaw/agents/*/sessions/*.jsonl` 2. 可见会话API：`sessions_list` / `sessions_history` 3. 技能来源：GitHub / ClawHub / SkillsMP / skills.sh 4. 已安装技能与agent配置：当前环境可见配置 ## 固定动作（必须按顺序） ### A. 全量覆盖分析 - 覆盖目标agent：main / qin / kongming / qianxuesen / miaoji（若可见） - 统计字段： - session数量 - 角色消息计数（user/assistant/toolResult） - 时间范围 - 主题命中（技能安装/定时运营/研究情报/协作调度/治理审批） - 输出覆盖率报告：已覆盖、未覆盖、覆盖率%、缺失原因 ``` ### Technical Analysis The Skill requires access to all available JSONL session histories across multiple Agents through a wildcard filesystem path and the `sessions_list` and `sessions_history` APIs. It also requests access to installed-skill information and visible Agent configuration. This access is broader than necessary for the stated aggregation tasks, which require session counts, role-message counts, date ranges, and topic classifications. These statistics can be generated from bounded metadata or redacted extracts without exposing complete message bodies or configuration values. The specification does not impose: - An approved list of Agents or sessions. - A bounded analysis period. - Field-level data minimization. - Secret and personal-data redaction. - Restrictions against reproducing raw messages or configuration values. - Retention and deletion controls. - Explicit authorization before accessing another Agent’s records. As a result, executing the Skill as written may cross least-privilege boundaries and unnecessarily expose credentials, personal information, proprietary discussions, system prompts, internal tool results, service endpoints, or other operational details. ### Attack Path 1. A privileged Agent loads and executes the Skill. 2. The Skill enumerates session files matching `~/.openclaw/agents/*/sessions/*.jsonl` or uses the ...[truncated 1350 chars]
- Remediation
- ## Remediation Suggestions 1. Require explicit authorization before reading histories or configuration belonging to another Agent. 2. Replace the unrestricted wildcard with an allowlist of approved Agent identifiers and session locations. 3. Define a short, explicit analysis window and reject records outside that period. 4. Prefer metadata-only APIs for session counts, role counts, and timestamps. 5. When topic classification requires content, extract only the minimum necessary text fields and redact credentials, tokens, personal data, and configuration values before processing. 6. Prohibit raw session messages, system prompts, tool results, and configuration secrets from appearing in generated reports. 7. Add per-Agent access checks and record which source was accessed, by whom, and for which approved purpose. 8. Establish retention and deletion rules for extracted data and generated reports. 9. Process suspicious or untrusted message content strictly as data, ensuring that instructions embedded in session histories are never executed. 10. Preserve the existing approval requirement for skill installation and configuration changes, and extend it to cross-Agent data access.