other
Warning
- Location
agents/openai.yaml:4- Finding
Implicit Invocation Enables Broad Retrieval of Sensitive Local Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
agents/openai.yaml:4-7; related data-access logic inscripts/openclaw_memory.py:75-101andscripts/openclaw_memory.py:104-149
Vulnerability Type: Sensitive Agent Memory Access
Risk Level: MediumVulnerable Code
agents/openai.yaml:4-7:yaml default_prompt: "Use $openclaw-memory to check remembered local servers, services, paths, workflow notes, and shared preferences before acting. Search markdown memory first, fall back to SQLite chunk text when needed, and append new durable facts to OpenClaw memory when appropriate." policy: allow_implicit_invocation: truescripts/openclaw_memory.py:75-101:python def search_markdown(query: str, limit: int) -> list[Result]: tokens = tokenize(query) results: list[Result] = [] for path in iter_markdown_files(): try: text = path.read_text(encoding="utf-8") except OSError: continue score = score_text(text, tokens) if score <= 0: continue results.append( Result( path=str(path), source="markdown", score=score, snippet=snippet_for(text, query), ) ) results.sort(key=lambda item: (-item.score, item.path)) return results[:limit]scripts/openclaw_memory.py:104-149:python def search_sqlite(query: str, limit: int) -> list[Result]: sqlite_db = sqlite_db_path() if not sqlite_db.exists(): return [] tokens = tokenize(query) if not tokens: return [] clauses = " OR ".join(["lower(text) LIKE ?" for _ in tokens]) params = [f"%{token}%" for token in tokens] sql = f""" SELECT path, text FROM chunks WHERE {clauses} ORDER BY updated_at DESC LIMIT ? """ try: ...[truncated 4263 chars]- Remediation
View remediation
Remediation Suggestions
- Set
allow_implicit_invocationtofalseso that memory access requires an explicit user request. - Require confirmation before searching memory when the request did not clearly ask for persistent local state.
- Introduce separate scopes for preferences, operational notes, infrastructure data, and daily history; search only the scope required by the request.
- Redact likely credentials, API keys, private keys, authentication headers, connection strings, and other secrets before generating snippets.
- Avoid returning absolute filesystem paths unless they are specifically required by the user.
- Add configurable allowlists for memory files and SQLite records that the Skill may inspect.
- Limit query breadth and repeated probing to reduce keyword-based enumeration of memory contents.
- Log memory-search invocations with the requesting context and selected scope, while ensuring that the audit log itself does not contain sensitive snippets.
- Document that memory results may contain sensitive operational data and must not be reproduced outside the authorized user context.
- Preserve the current absence of networking behavior; do not add remote telemetry or external search without explicit consent and strict data minimization.
- Set