T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- scripts/neon-soul.mjs:45
- Finding
- Undisclosed Default Collection and Processing of OpenClaw Conversation Logs<![CDATA[ ## Vulnerability Details **File Location**: `scripts/neon-soul.mjs:45`, `scripts/neon-soul.mjs:410`; documentation mismatch in `SKILL.md:29-38` and `SKILL.md:151-163` **Vulnerability Type**: Excessive local-data access and violation of least privilege **Risk Level**: High ### Vulnerable Code ```js ji={ includeSoul:!0, includeUserContext:!0, includeInterviews:!0, includeSessionLogs:!0, memoryCategories:[] } ``` The default session-log source is outside the documented `memory/` directory: ```js if(n.includeSessionLogs){ let u=Ui(n.sessionLogPath||"~/.openclaw/agents/main/sessions"); je(u)&&(p=await Ii(u), r.sessionFileCount=p.length, r.sessionMessageCount=Di(p), r.totalSources+=p.length) } ``` The synthesis pipeline invokes source collection without disabling these additional default sources: ```js let a=await zi(o,{includeSoul:s??!1}) ``` Collected session content is subsequently passed to the configured LLM: ```js let w=It(v); if(w.trim().length>0){ let k=await ze(i,w,{file:v.path,category:"session"}); o.push(...k) } ``` ### Technical Analysis The declared synthesis functionality focuses on reading Markdown files from `memory/` and generating `SOUL.md`. The Skill metadata similarly declares `memory/` and `.neon-soul/` as state directories. However, the implementation enables ingestion of session logs, `USER.md`, and interview data by default. In particular, it reads JSONL conversation histories from `~/.openclaw/agents/main/sessions` without requiring a dedicated command-line option or explicit user confirmation. These logs can contain private conversations, credentials pasted into chat, tool results, internal prompts, personal identifiers, or information unrelated to identity synthesis. After collection, session messages are converted into prompts and processed by the configured Ollama-compatible endpoint. Extracted signals and provenance are also retained in `.neon-soul/` data files. Thus, the access is broad ...[truncated 1511 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Change the source defaults so that only the explicitly documented `memory/` directory is processed: ```js { includeSoul: false, includeUserContext: false, includeInterviews: false, includeSessionLogs: false, memoryCategories: [] } ``` 2. Add explicit opt-in flags such as: - `--include-sessions` - `--include-user-context` - `--include-interviews` - `--session-log-path <path>` 3. Before processing optional sensitive sources, display: - Every selected source directory - Number of files and messages - Configured LLM destination - Whether the destination is local or remote 4. Require affirmative confirmation before sending session content to a non-loopback endpoint. 5. Add secret and credential redaction before prompt construction, including patterns for API keys, authorization headers, private keys, access tokens, passwords, and session cookies. 6. Provide source exclusions by file, session, date range, and message role. 7. Update `SKILL.md` and metadata to disclose every default read location accurately. If session processing remains supported, declare the session directory as required state access. 8. Avoid storing raw or closely paraphrased sensitive content where only aggregate identity information is needed. Apply retention limits and provide a command that securely removes all derivative records. ]]>