T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:119
- Finding
- Global Session Visibility Violates Least-Privilege Isolation## Vulnerability Details **File Location**: `SKILL.md`, lines 119–127 **Vulnerability Type**: Excessive session access permissions **Risk Level**: Medium The documented configuration enables global session visibility: ```markdown ## 安裝配置 ### 1. openclaw.json — sessions 可見性 ```json { "tools": { "sessions": { "visibility": "all" } } } ``` ``` ### Technical Analysis Setting `tools.sessions.visibility` to `"all"` grants session visibility beyond the department-specific collaboration boundaries described elsewhere in the skill. This configuration is broader than necessary for agents that only need access to sessions associated with their assigned tasks. If an untrusted, compromised, or incorrectly configured agent has access to the session tools, global visibility may allow it to discover or interact with unrelated sessions. This weakens isolation between departments and conflicts with the skill's stated scope-isolated operating model. The issue is an access-control weakness rather than evidence of intentional malicious behavior. Exploitation depends on the affected agent also possessing session-tool capabilities. ### Attack Path 1. An administrator applies the documented configuration and sets session visibility to `"all"`. 2. A low-privilege departmental agent is granted access to session discovery or messaging tools. 3. The agent becomes compromised, receives malicious instructions, or acts outside its intended scope. 4. The agent uses globally visible session metadata to identify sessions belonging to other departments. 5. Where supported by its tool permissions, the agent reads session context or sends messages into those unrelated sessions. 6. Information from finance, operations, content, or other departments may be disclosed or manipulated outside the intended trust boundary. ### Impact Assessment A successful exploit could permit cross-department session discovery, unauthorized disclosure of conversation context, and unintended ...[truncated 495 chars]
- Remediation
- ## Remediation Suggestions 1. Replace global session visibility with explicit per-agent or per-department access controls. 2. Allow each agent to access only sessions it created, sessions explicitly delegated to it, or sessions associated with an approved collaboration. 3. Use narrowly scoped allowlists for authorized agent and session identifiers. 4. Separate session discovery, read, and send permissions so agents receive only the operations required for their duties. 5. Revoke temporary cross-department access immediately after a collaboration ends. 6. Validate authorization server-side for every session read or message operation rather than relying solely on visibility settings. 7. Record and monitor cross-department session access, including the requesting agent, target session, operation, and authorization decision. 8. Document any exceptional need for global visibility and restrict that capability to a trusted coordinating agent such as Main.