T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/scan_environment.sh:14- Finding
Environment scan exposes identity content and performs overbroad workspace reconnaissance
- Content
View full analysis
Vulnerability Details
File Location:
scripts/scan_environment.sh:14-15, 47-58, 63-72, 78-98; workflow invocation documented inSKILL.md:30-34
Vulnerability Type: Excessive collection and disclosure of local identity and environment data
Risk Level: MediumVulnerable Code
bash WORKSPACE="${1:-$(pwd)}" SKILL_DIRS=("$HOME/.agents/skills" "$HOME/git/openclaw/skills" "$WORKSPACE/skills")bash # --- 2. User Identity --- echo "## USER IDENTITY" echo "" for f in SOUL.md USER.md IDENTITY.md; do fpath="$WORKSPACE/$f" if [ -f "$fpath" ]; then echo "### $f" head -30 "$fpath" 2>/dev/null echo "" else echo "### $f — NOT FOUND" echo "" fi donebash # --- 3. Channel Configuration --- echo "## CHANNELS" echo "" config_dir="$HOME/.openclaw" if [ -d "$config_dir" ]; then # Check for common channel configs for channel in feishu wecom telegram discord slack whatsapp signal; do if grep -rql "$channel" "$config_dir"/*.yaml "$config_dir"/*.yml "$config_dir"/*.json 2>/dev/null; then echo "- ✅ $channel (configured)" fi done else echo "- No OpenClaw config directory found" fibash # --- 4. Workspace State --- echo "## WORKSPACE STATE" echo "" for f in HEARTBEAT.md MEMORY.md AGENTS.md TOOLS.md; do fpath="$WORKSPACE/$f" if [ -f "$fpath" ]; then lines=$(wc -l < "$fpath" 2>/dev/null || echo "0") size=$(wc -c < "$fpath" 2>/dev/null || echo "0") echo "- $f: ${lines} lines, ${size} bytes" else echo "- $f: NOT FOUND" fi done # Check memory directory if [ -d "$WORKSPACE/memory" ]; then mem_count=$(ls "$WORKSPACE/memory"/*.md 2>/dev/null | wc -l || echo "0") echo "- memory/: ${mem_count} daily files" else echo "- memory/: NOT FOUND" fiTechnical Analysis
The scan directly copies the first 30 lines of
SOUL.md,USER.md, and ...[truncated 2397 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit user approval before reading each category of local information: identity, installed skills, channel configuration, memory state, and workspace metadata.
- Do not print raw identity-file lines by default. Extract only an explicitly permitted field such as a role name, or report only that the file exists.
- Add an opt-in flag such as
--include-identity-content; keep the secure default metadata-only. - Redact secrets, tokens, email addresses, phone numbers, private URLs, and other sensitive values before writing any content to standard output.
- Resolve the workspace with
realpathand verify it is within an approved root before scanning it. Reject arbitrary or unexpected paths. - Make home-directory skill and configuration scans individually optional rather than enabling them automatically.
- Replace broad configuration-file content searches with a parser that reads only documented, non-secret channel-enable fields.
- Clearly label generated reports as potentially sensitive and discourage retaining them in shared logs or model contexts.
- Add tests confirming that credentials and unrelated identity content never appear in default output.