T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:17- Finding
Overbroad Cross-Domain Access and Automatic Persistence of Sensitive Travel Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:17-44,memory-template.md:5-37,memory-template.md:236-250, andpassengers.md:88
Vulnerability Type: Excessive permissions and violation of least privilege
Risk Level: MediumComplete Code Snippets
SKILL.md:17-35:yaml configPaths: - ~/Clawic/data/flight/ - ~/Clawic/data/bookings/ - ~/Clawic/data/contacts/ - ~/Clawic/data/finances/ - ~/Clawic/data/projects/ - ~/Clawic/profile.yaml - ~/flight/ - ~/clawic/flight/ openclaw: requires: config: - ~/Clawic/data/flight/ - ~/Clawic/data/bookings/ - ~/Clawic/data/contacts/ - ~/Clawic/data/finances/ - ~/Clawic/data/projects/ - ~/Clawic/profile.yaml - ~/flight/ - ~/clawic/flight/SKILL.md:38-44:markdown **Data.** At the start of every session, read `~/Clawic/data/flight/config.yaml` (what the user declared) and `~/Clawic/data/flight/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition written on its line applies — that index *is* the list of files; never work from a list of names carried in your head, because most boxes are created after this skill was written. Read `~/Clawic/data/bookings/<current year>.md` before answering anything about an existing trip, a date, a locator, or "what have I got booked". If none of it exists, work from defaults and say nothing about it. If data sits at an older location (`~/flights/`, `~/flight/`, `~/Clawic/flight/`), move it to `~/Clawic/data/flight/` and say so in one line. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. **Write be ...[truncated 9603 chars]- Remediation
View remediation
Remediation Suggestions
- Restrict the declared access scope to
~/Clawic/data/flight/by default. Grant access to individual booking, contact, finance, or project files only when a specific user request requires it. - Replace directory-wide permissions with file-level allowlists wherever the host platform supports them.
- Require explicit user consent before the first persistent read or write, before storing third-party traveller information, and before accessing shared contacts or finances.
- Make persistence opt-in rather than mandatory. Provide a session-only mode for flight search and general advice.
- Validate and canonicalize every path obtained from
## Boxes. Reject absolute paths, traversal components, symbolic-link escapes, and paths outside a narrow approved root. - Do not treat mutable memory as an authorization source. Keep authorization policy in immutable Skill configuration.
- Minimize retained information. Use aliases or pseudonymous traveller identifiers and avoid storing record locators, ticket numbers, email addresses, or loyalty numbers unless essential.
- Separate flight records from shared contacts and finances. Exchange only narrowly defined references through an explicit interface.
- Introduce retention limits, per-record provenance, audit logging, and user-accessible deletion controls.
- Require confirmation before moving or deleting existing records, even when the Skill believes it originally created them.
- Encrypt sensitive local records at rest and apply operating-system permissions that prevent unrelated Skills or users from reading them.
- Add tests proving that flight-search requests cannot read contacts, finances, projects, or unrelated booking rows.
- Restrict the declared access scope to