T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:19
- Finding
- Unnecessarily Broad Retrieval of Credential-Bearing Configuration## Vulnerability Details **File Location**: `SKILL.md:19-48`, `SKILL.md:89-94`, `references/common-paths.md:10-17`, `references/common-paths.md:39-82`, and `references/common-paths.md:111-119` **Vulnerability Type**: Excessive access to sensitive configuration **Risk Level**: Medium The skill directs the agent to retrieve the complete OpenClaw configuration before and after every modification, even when the requested operation concerns only one configuration field. Relevant command: ```text gateway config.get ``` The referenced configuration can contain credentials such as: ```json { "apiKey": "sk-...", "token": "YOUR_BOT_TOKEN", "token": "YOUR_GATEWAY_TOKEN" } ``` The recommended modification workflow also uses: ```text gateway config.patch { "channels": { "discord": { "enabled": true, "token": "YOUR_TOKEN" } } } ``` ### Technical Analysis Retrieving an entire configuration object for a narrowly scoped change violates the principle of least privilege. The documented configuration structure includes provider API keys, channel tokens, and gateway authentication tokens. Consequently, a full `gateway config.get` response may expose credentials unrelated to the user's requested operation. If the gateway does not automatically redact secrets, these values can enter the agent context, tool logs, conversation transcripts, debugging records, or other downstream processing systems. The skill provides no instruction to request only a configuration subtree, redact credentials, suppress sensitive output, or obtain confirmation before reading the complete configuration. This issue does not independently grant new operating-system privileges and does not contain an exfiltration mechanism. Exploitation is limited to the configuration-read privileges already held by the agent or gateway session. The practical severity therefore depends on the gateway's authorization controls ...[truncated 1440 chars]
- Remediation
- ## Remediation Suggestions 1. Replace mandatory full-configuration retrieval with path-scoped or subtree-scoped reads whenever the gateway supports them. 2. Retrieve only the configuration section required for the requested change, such as `channels.discord`, rather than the complete configuration. 3. Explicitly require secret redaction for API keys, bot tokens, gateway tokens, passwords, and authorization headers. 4. Do not reproduce credential values in chat responses, logs, validation output, or error messages. 5. Validate only the modified subtree after applying a patch instead of retrieving the entire configuration again. 6. If full retrieval is technically unavoidable, require explicit operator confirmation and ensure the response is processed through a redaction layer before entering agent context. 7. Use secret references or environment-variable placeholders instead of plaintext credential values where OpenClaw supports them. 8. Document credential rotation procedures for cases where configuration output may have been stored in transcripts or logs. 9. Restrict `config.get` and `config.patch` through gateway authorization policies so the agent can access only configuration namespaces necessary for its assigned role.