T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:23- Finding
Excessive Conversation-History Profiling and Contradictory Privacy Claim
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 23–26 and line 44
Vulnerability Type: Excessive access to sensitive conversation history and external disclosure without a defined consent boundary
Risk Level: MediumVulnerable Code
markdown 1. Your agent builds a deep psychological profile from your LLM conversation history 2. The profile is sent to the SynClaw server for matching 3. Your agent evaluates compatibility with candidates using LLM-powered analysis 4. You chat through agents until you decide to exchange contactsmarkdown Built on OpenClaw. Your data stays local. Always.Technical Analysis
The documented workflow instructs the agent to derive a deep psychological profile from the user's LLM conversation history. That history may contain credentials, private correspondence, health information, financial information, identifying data, and material unrelated to compatibility matching. No instruction limits collection to user-selected conversations or to fields necessary for matching.
The profile is then documented as being sent to an unspecified SynClaw server. The skill does not define an informed-consent step, destination endpoint, authentication mechanism, encryption requirement, redaction process, retention policy, deletion mechanism, or restriction on secondary use.
This external transmission directly conflicts with the unconditional statement that user data “stays local. Always.” Although the transmitted artifact may be a derived profile rather than raw messages, psychological inferences are sensitive personal data and are still user data. This inconsistency could cause users to authorize the skill under a materially inaccurate privacy expectation.
The reviewed package contains only documentation, and the feature is explicitly marked as “Coming soon.” Consequently, the repository does not demonstrate that collection or transmission is currently implemented. The f ...[truncated 1877 chars]
- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed, opt-in consent before reading conversation history or transmitting any raw or derived information.
- Allow users to select the exact conversations or messages used for profiling; do not default to unrestricted history access.
- Apply data minimization by collecting only attributes necessary for the selected matching purpose.
- Detect and redact credentials, authentication tokens, financial data, health information, contact details, and unrelated third-party information before analysis or transmission.
- Clearly identify the server operator, destination endpoint, data categories transmitted, processing purposes, retention period, deletion process, and any subprocessors.
- Require authenticated HTTPS transport and appropriate encryption for stored profiles.
- Provide a local-only profile-generation option and show the complete profile to the user for review and editing before transmission.
- Implement revocation and deletion controls covering both the active profile and server-side backups where feasible.
- Replace “Your data stays local. Always.” with an accurate disclosure. If only raw conversations remain local while a derived profile is transmitted, state that distinction prominently.
- Add implementation-level authorization checks and tests ensuring that the skill cannot inspect history or contact the server until consent is recorded.