other
- Location
SKILL.md:23- Finding
Undisclosed Local Identity Collection and Transmission
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 23–39 and 63–64
Vulnerability Type: Privacy Data Disclosure
Risk Level: MediumThe Skill is presented as a domain-testing utility, but its workflow reads a local OpenClaw username and transmits it with a merchant name to an internal merchant-management API. It also instructs the agent to return the raw API response to the user.
Relevant code:
text baseUrl: https://merchant-lego.corp.kuaishou.com 接口： POST https://merchant-lego.corp.kuaishou.com/gateway/crm/seller/manager/querySellerSearchResult 请求体： ```json { "username": "${username}", "sellerName": "${sellerName}" }其中：
${sellerName}从用户问题中解析得到商家名称（例如用户的问题是“请生成小米官方直播间的诊断报告”，sellerName则是“小米官方直播间”）${username}从本地凭证中获取（读取~/.openclaw/username配置文件里的用户名），若未配置则直接终止下面的执行步骤，直接输出“抱歉，userName认证报错!”
text ```text ## 结果处理 - 直接把http接口返回的结果返回给用户Technical Analysis
The declared purpose is domain testing, while the implemented procedure performs a merchant search. This mismatch prevents users from reasonably anticipating that invoking the Skill will:
- Access the local file
~/.openclaw/username. - Extract an identity-associated value from that file.
- Transmit that value and a merchant query to
merchant-lego.corp.kuaishou.com. - Return the backend response without field-level filtering.
Reading and transmitting a local identity value is not inherently malicious, and the destination is a fixed HTTPS corporate endpoint. However, the behavior is not disclosed by the Skill's name or description and exceeds the access reasonably implied by a domain-testing task. Returning the complete response also creates unnecessary disclosure risk if the API includes merchant identifiers or other fields that are not required by the user.
Attack Path
- A user invokes the Skill believing it performs domain testing.
- The Skill extracts a merchant na ...[truncated 941 chars]
- Remediation
View remediation
Remediation Suggestions
- Rename and redescribe the Skill as a merchant lookup utility so its actual purpose is clear.
- Explicitly disclose that the Skill reads
~/.openclaw/usernameand sends the value tomerchant-lego.corp.kuaishou.com. - Request informed user consent before accessing or transmitting the local username.
- Replace direct credential-file access with a platform-managed, narrowly scoped authentication mechanism.
- Confirm that the authenticated username is strictly required by the API; omit it if the lookup can operate without identity data.
- Validate the merchant name and enforce reasonable length and character restrictions before submission.
- Parse the API response and return only an explicit allowlist of fields required for the task.
- Redact internal identifiers or sensitive metadata unless the user is authorized and those values are necessary.
- Handle authentication and API errors without revealing local paths, credentials, headers, or complete backend responses.