T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- setup.sh:92
- Finding
- ACP Agents Are Granted Global Session Access and Automatic Permission Approval<![CDATA[ ## Vulnerability Details **File Location**: `setup.sh:92-93` and `setup.sh:112-113` **Vulnerability Type**: Excessive permissions and insufficient access isolation **Risk Level**: High ### Vulnerable Code ```bash openclaw config set plugins.entries.acpx.enabled true openclaw config set plugins.entries.acpx.config.permissionMode approve-all ``` ```bash openclaw config set tools.sessions.visibility all openclaw config set tools.agentToAgent.enabled true ``` ### Technical Analysis The installation script configures the ACP runtime to approve all permission requests automatically. It also makes all sessions visible and globally enables agent-to-agent communication. These settings weaken multiple security boundaries simultaneously: - `permissionMode approve-all` removes interactive authorization for sensitive ACP operations. - `tools.sessions.visibility all` exposes sessions unrelated to the delegated coding task. - `tools.agentToAgent.enabled true` permits cross-agent interaction globally rather than limiting communication to the parent and its explicitly created child sessions. The skill is intended to delegate coding tasks, but that purpose does not inherently require access to every OpenClaw session. Coding agents commonly inspect untrusted repositories, documentation, issue text, test fixtures, and source-code comments. Content in those resources can contain prompt-injection instructions. With automatic approval and global session visibility, a successfully injected or compromised child agent could attempt operations outside the scope of the requested coding task. ### Attack Path 1. A user asks the skill to review or modify an untrusted repository. 2. A repository file contains instructions designed to manipulate the delegated coding agent. 3. The child agent processes that content as part of its analysis. 4. The injected instructions direct the agent to inspect unrelated OpenClaw sessions or communicate with another agent. 5. Global session ...[truncated 1097 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace `approve-all` with an interactive, policy-based, or least-privilege permission mode. 2. Restrict session visibility to the current session or the explicitly established parent-child session relationship. 3. Keep agent-to-agent communication disabled by default and enable it only when a specific workflow requires it. 4. Require explicit user consent before applying security-sensitive global configuration changes. 5. Create a dedicated low-privilege operating-system account or sandbox for coding agents. 6. Restrict agent filesystem access to the requested project directory. 7. Deny access to credential stores, SSH keys, cloud configuration, unrelated workspaces, and OpenClaw session data unless explicitly needed. 8. Apply allowlists to tools and operations available to child agents. 9. Preserve existing restrictive user settings rather than unconditionally replacing them. 10. Clearly document each permission change and provide a rollback command for every global setting. ]]>