T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/neon-soul.mjs:45- Finding
Undisclosed Default Collection and Processing of OpenClaw Conversation Logs
- Content
View full analysis
0){ let k=await ze(i,w,{file:v.path,category:"session"}); o.push(...k) } ``` ### Technical Analysis The declared synthesis functionality focuses on reading Markdown files from `memory/` and generating `SOUL.md`. The Skill metadata similarly declares `memory/` and `.neon-soul/` as state directories. However, the implementation enables ingestion of session logs, `USER.md`, and interview data by default. In particular, it reads JSONL conversation histories from `~/.openclaw/agents/main/sessions` without requiring a dedicated command-line option or explicit user confirmation. These logs can contain private conversations, credentials pasted into chat, tool results, internal prompts, personal identifiers, or information unrelated to identity synthesis. After collection, session messages are converted into prompts and processed by the configured Ollama-compatible endpoint. Extracted signals and provenance are also retained in `.neon-soul/` data files. Thus, the access is broad ...[truncated 1511 chars]- Remediation
View remediation
` 3. Before processing optional sensitive sources, display: - Every selected source directory - Number of files and messages - Configured LLM destination - Whether the destination is local or remote 4. Require affirmative confirmation before sending session content to a non-loopback endpoint. 5. Add secret and credential redaction before prompt construction, including patterns for API keys, authorization headers, private keys, access tokens, passwords, and session cookies. 6. Provide source exclusions by file, session, date range, and message role. 7. Update `SKILL.md` and metadata to disclose every default read location accurately. If session processing remains supported, declare the session directory as required state access. 8. Avoid storing raw or closely paraphrased sensitive content where only aggregate identity information is needed. Apply retention limits and provide a command that securely removes all derivative records. ]]>