T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/utils.js:93- Finding
WhatsApp Contact PII Exposed Through Standard Output
- Content
View full analysis
id.endsWith('@s.whatsapp.net')) .map(([id, c]) => ({ phone: id.replace('@s.whatsapp.net', ''), name: c.name || c.notify || null, isBusiness: c.isBusiness || false })); console.log(JSON.stringify({ total: exported.length, contacts: exported }, null, 2)); } catch (error) { console.log(JSON.stringify({ error: error.message })); } } ``` ### Technical Analysis The `export-contacts` command reads `contacts.json` from the OpenClaw WhatsApp credential-state directory and prints the entire contact list to standard output. The disclosed fields include telephone numbers, contact names, and business-account status. Although exporting contacts is an advertised feature, returning the complete dataset through standard output creates a secondary disclosure channel. Output from agent-executed commands may be incorporated into conversation history, execution traces, monitoring systems, CI logs, or other records with broader access and longer retention than the source credential directory. The implementation does not request explicit confirmation, support record selection, redact sensitive fields, or restrict the volume of personal data returned. ### Attack Path 1. The attacker or an untrusted workflow obtains the ability to invoke this skill in a context that can access the user's OpenClaw state directory. 2. The attacker invokes `node scr ...[truncated 1177 chars]- Remediation
View remediation