T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:32- Finding
Overbroad Read and Write Access to Persistent Agent State
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:32, 45-47, 104-106, 170, 234-237
Vulnerability Type: Excessive access to sensitive workspace files and persistent Agent configuration
Risk Level: MediumRelevant Skill Instructions
The following is an English rendering of the relevant instructions:
markdown | Validate organization | Read all core files | | 4 | user.md | User context | User information, preferences, infrastructure | | 5 | memory.md | Long-term memory | Important events, key configurations, workflows | | 6 | tools.md | Technical settings | Endpoints, hosts, commands, services | | read | Read core files | Required | | write | Modify core files | Required | | edit | Repair sections | Optional | | exec | Verify file state and create backups | Optional | 2. Does it already exist elsewhere? → Check all six core files | Missing file | Create it from scratch using the correct format | | New Agent setup | Create all six core files plus bootstrap.md |Technical Analysis
The Skill directs the Agent to read all core workspace files when validating organization. Those files are expressly documented as containing user information, infrastructure details, long-term memory, endpoints, hosts, commands, behavioral rules, and startup instructions.
It also declares workspace-wide write access as required and permits optional command execution. The instructions do not establish task-specific file allowlists, field-level access restrictions, trust-boundary checks, or mandatory user confirmation before individual files are read or modified. Consequently, a narrow request, such as checking the organization of one file, can cause access to substantially more sensitive state than is necessary.
Write access includes persistent files such as
memory.md,agents.md,identity.md, andbootstrap.md. If untrusted content is processed during a management operation, th ...[truncated 2198 chars]- Remediation
View remediation
Remediation Suggestions
- Replace the instruction to read all core files with task-scoped access. Read only the file necessary for the current request.
- Require explicit user approval before reading sensitive files such as
user.md,memory.md, ortools.md. - Separate read-only validation from modification workflows. Organizational checks should not automatically receive write permission.
- Require per-file confirmation before modifying persistent files, especially
agents.md,memory.md,identity.md, andbootstrap.md. - Present an exact diff and destination path before every write, then require user approval.
- Treat file contents and user-supplied text as untrusted data. Do not interpret embedded instructions while reorganizing or copying content.
- Add an allowlist defining which content types and fields may be written to each core file.
- Prohibit transferring instructions from untrusted sources into behavioral, memory, tool, or startup files without independent validation.
- Prefer dedicated read, write, and edit operations over
exec. If command execution is unavoidable, restrict it to fixed commands and validated workspace paths. - Enforce canonical-path checks so file operations cannot escape
~/.openclaw/workspace/through traversal or symbolic links. - Retain backups outside the active core-file glob and verify backups before overwriting existing state.
- Record an audit log identifying the requesting user, files accessed, approved changes, and final write results.