T05 · Unauthorized Access and Privilege Escalation
- Location
SKILLS.md:26- Finding
Cross-Project File Access Violates Least-Privilege Boundaries
- Content
View full analysis
Vulnerability Details
File Location:
SKILLS.md, lines 26-28
Vulnerability Type: Unauthorized cross-project file read and write
Risk Level: MediumVulnerable Code
markdown #### Phase 4: Chaining & Cross-Verification (Critical) * **Action:** Consume data from `~/.openclaw/swarm_tmp/expert_output.json` if available. * **Serialization:** Map findings into the local `audit_schema.json`. * **Persistence:** Write the final report to `~/.openclaw/swarm_tmp/audit_report.json`.Technical Analysis
The Skill directs the Agent to read from and write to shared paths outside the project directory. These operations are not necessary for the core first-principles analysis described by the Skill and therefore exceed the minimum file permissions required for its stated purpose.
The instructions provide no safeguards for:
- Verifying the ownership or provenance of
expert_output.json - Validating imported content against a strict schema
- Limiting input size
- Preventing symbolic-link traversal
- Preventing overwrite of an existing report
- Ensuring that writes are atomic
- Obtaining explicit user authorization for shared-state access
Consequently, an attacker with write access to the shared temporary directory could supply manipulated expert output or redirect either path through a symbolic link. Although no executable code is present, untrusted content could influence the Agent's conclusions, while an unsafe output target could overwrite data accessible to the Agent.
Attack Path
- An attacker gains write access to
~/.openclaw/swarm_tmpor causes a malicious file or symbolic link to exist there. - The attacker creates a crafted
expert_output.jsoncontaining misleading or adversarial content, or redirects the input path to another readable file. - When the Skill runs, its instructions cause the Agent to consume that external content without provenance or integrity checks.
- The manipulated content affects the generated audit ...[truncated 840 chars]
- Verifying the ownership or provenance of
- Remediation
View remediation
Remediation Suggestions
- Default all input and output paths to a dedicated project-local directory.
- Require explicit user authorization before reading or writing any path outside the project root.
- Treat imported expert output as untrusted data and validate it against a strict schema before use.
- Enforce canonical-path containment checks and reject symbolic links for both input and output files.
- Apply file-size and nesting limits before parsing JSON.
- Create output files with exclusive creation semantics and restrictive permissions.
- Write to a verified temporary file and atomically rename it to the final destination.
- Refuse to overwrite existing files unless the user explicitly approves the operation.
- Record the source and integrity metadata of imported reports so downstream workflows can distinguish trusted from untrusted content.