T09 · Insecure Skill Coding Practices
Note
- Location
- scripts/memory_tree.py:221
- Finding
- Overbroad Access to Credential-Bearing OpenClaw Configuration## Vulnerability Details **File Location**: `scripts/memory_tree.py:30`, `scripts/memory_tree.py:221-233`, `scripts/memory_tree.py:359-371` **Vulnerability Type**: Excessive configuration access and unsafe recipient inference **Risk Level**: Low ### Complete Code Snippet ```python OPENCLAW_CONFIG = Path.home() / ".openclaw" / "openclaw.json" ``` ```python def detect_enabled_channels(): """从 openclaw.json 检测已启用的推送渠道""" config = load_json(OPENCLAW_CONFIG) channels = config.get('channels', {}) enabled = [] for name, cfg in channels.items(): if cfg.get('enabled', False): enabled.append({ 'name': name, 'config': cfg, }) return enabled ``` ```python channels = detect_enabled_channels() if channels: print(f"📡 检测到已启用渠道: {', '.join(c['name'] for c in channels)}") for ch in channels: if ch['name'] == 'feishu': chat_id = get_feishu_chat_id(ch['config']) if chat_id: print(f"\n📱 飞书推送配置:") print(f" chat_id: {chat_id}") print(f"\n💡 推送命令:") print(f" message send --target {chat_id} --file {report_file}") ``` ### Technical Analysis The `weekly` operation reads the complete `~/.openclaw/openclaw.json` file and retains the complete configuration object for every enabled channel. Local weekly-report generation does not require access to channel credentials or unrelated channel settings. Although the current implementation does not print credentials or transmit the report, retaining complete channel configuration objects unnecessarily expands the sensitive-data exposure surface. A future logging statement, exception handler, plugin, or modification could inadvertently disclose secrets stored in those objects. The code also chooses the first entry in Feishu's `groupAllowFrom` list as the suggested destination. That list is an access-control list, not necessarily an ...[truncated 1427 chars]
- Remediation
- ## Remediation Suggestions 1. Keep weekly-report generation local by default and do not read `openclaw.json` unless the user explicitly requests sharing. 2. Require an explicit `--share` and `--target` argument before preparing or performing external delivery. 3. Extract only the minimum required values instead of retaining each complete channel configuration object. 4. Never place authentication tokens, secrets, or complete configuration mappings into returned data structures. 5. Do not infer a report recipient from `groupAllowFrom`; treat authorization lists and delivery destinations as separate concepts. 6. Display the selected recipient and require explicit confirmation before any future transmission feature. 7. Add tests confirming that local report generation does not access channel credentials or perform network operations.