T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:25- Finding
Unbounded Psychological Profiling and External Disclosure of Conversation-Derived Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 25–28
Vulnerability Type:T05: Unauthorized Access and Privilege Escalation
Risk Level: HighVulnerable Code Snippet:
markdown ## How it works 1. Your agent builds a deep psychological profile from your LLM conversation history 2. The profile is sent to the MindMatch server for matching 3. Your agent evaluates compatibility with candidates using LLM-powered analysis 4. You chat through agents until you decide to exchange contactsThe external transmission described above also conflicts with the assurance at
SKILL.md, line 44:markdown Built on OpenClaw. Your data stays local. Always.Technical Analysis
The skill instructs the agent to access the user's LLM conversation history and derive a deep psychological profile. Conversation history can contain credentials, private communications, health information, business data, identifying information, and other sensitive material unrelated to compatibility matching. No restriction limits access to user-selected messages or to information necessary for the immediate task.
The resulting profile is then sent to an unspecified MindMatch server. The skill provides no server endpoint, operator identity, payload definition, authentication mechanism, transport requirements, retention policy, deletion procedure, or informed-consent workflow. It also does not give the user an opportunity to review or redact the profile before transmission.
This breaks least-privilege principles by requesting broad access to historical conversations rather than narrowly scoped, purpose-specific input. Although the text refers to sending a derived profile rather than necessarily sending raw messages, sensitive attributes and information can still be reproduced or inferred in that profile. The claim that data “stays local” is materially inconsistent with the stated external transmission and can prevent users ...[truncated 1621 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed, purpose-specific opt-in before accessing conversation history or transmitting any derived information.
- Replace unrestricted history access with user-selected messages or a dedicated questionnaire containing only data necessary for compatibility matching.
- Display the complete outbound payload and destination to the user, and require confirmation before each transmission.
- Remove direct identifiers, credentials, unrelated conversation content, and unnecessary sensitive attributes before processing or disclosure.
- Document the service operator, exact endpoint, data schema, processing purpose, subprocessors, retention period, deletion mechanism, and incident-response contact.
- Require authenticated HTTPS transport and appropriate server-side access controls, encryption at rest, audit logging, retention limits, and verifiable deletion.
- Provide a local-only profiling and matching mode where feasible.
- Correct the statement “Your data stays local. Always.” If any data leaves the local environment, replace it with an accurate and prominent disclosure describing exactly what is transmitted.
- Add controls preventing the profile from including secrets or sensitive data from unrelated historical conversations.