T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:17
- Finding
- Overbroad Cross-Domain Access and Automatic Persistence of Sensitive Travel Data## Vulnerability Details **File Location**: `SKILL.md:17-44`, `memory-template.md:5-37`, `memory-template.md:236-250`, and `passengers.md:88` **Vulnerability Type**: Excessive permissions and violation of least privilege **Risk Level**: Medium ### Complete Code Snippets `SKILL.md:17-35`: ```yaml configPaths: - ~/Clawic/data/flight/ - ~/Clawic/data/bookings/ - ~/Clawic/data/contacts/ - ~/Clawic/data/finances/ - ~/Clawic/data/projects/ - ~/Clawic/profile.yaml - ~/flight/ - ~/clawic/flight/ openclaw: requires: config: - ~/Clawic/data/flight/ - ~/Clawic/data/bookings/ - ~/Clawic/data/contacts/ - ~/Clawic/data/finances/ - ~/Clawic/data/projects/ - ~/Clawic/profile.yaml - ~/flight/ - ~/clawic/flight/ ``` `SKILL.md:38-44`: ```markdown **Data.** At the start of every session, read `~/Clawic/data/flight/config.yaml` (what the user declared) and `~/Clawic/data/flight/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition written on its line applies — that index *is* the list of files; never work from a list of names carried in your head, because most boxes are created after this skill was written. Read `~/Clawic/data/bookings/<current year>.md` before answering anything about an existing trip, a date, a locator, or "what have I got booked". If none of it exists, work from defaults and say nothing about it. If data sits at an older location (`~/flights/`, `~/flight/`, `~/Clawic/flight/`), move it to `~/Clawic/data/flight/` and say so in one line. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. **Write be ...[truncated 9603 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict the declared access scope to `~/Clawic/data/flight/` by default. Grant access to individual booking, contact, finance, or project files only when a specific user request requires it. 2. Replace directory-wide permissions with file-level allowlists wherever the host platform supports them. 3. Require explicit user consent before the first persistent read or write, before storing third-party traveller information, and before accessing shared contacts or finances. 4. Make persistence opt-in rather than mandatory. Provide a session-only mode for flight search and general advice. 5. Validate and canonicalize every path obtained from `## Boxes`. Reject absolute paths, traversal components, symbolic-link escapes, and paths outside a narrow approved root. 6. Do not treat mutable memory as an authorization source. Keep authorization policy in immutable Skill configuration. 7. Minimize retained information. Use aliases or pseudonymous traveller identifiers and avoid storing record locators, ticket numbers, email addresses, or loyalty numbers unless essential. 8. Separate flight records from shared contacts and finances. Exchange only narrowly defined references through an explicit interface. 9. Introduce retention limits, per-record provenance, audit logging, and user-accessible deletion controls. 10. Require confirmation before moving or deleting existing records, even when the Skill believes it originally created them. 11. Encrypt sensitive local records at rest and apply operating-system permissions that prevent unrelated Skills or users from reading them. 12. Add tests proving that flight-search requests cannot read contacts, finances, projects, or unrelated booking rows.