T05 · Unauthorized Access and Privilege Escalation
Error
- Location
SKILL.md:81- Finding
Unauthenticated Proxy Access to Private Images and Keyframes
- Content
View full analysis
&blob=" ``` 2. **Send** via OpenClaw message CLI: ```bash openclaw message send --channel --target --media /path/to/workspace/image.jpg --message "caption" ``` ``` `SKILL.md:176`: ```text Image and keyframe results return `bucket` and `blob` (no signed URLs). To get the actual image bytes, hit the proxy endpoint — see "Returning Images/Keyframes to User" above. The endpoint streams the JPEG bytes directly with no expiration or auth on the client side. ``` `scripts/run.py:159-163`: ```python if img.get("text"): lines.append(f" {img['text']}") lines.append(f" bucket: {img.get('bucket')}, blob: {img.get('blob')}") if img.get("location"): lines.append(f" Location: {img['location']}") ``` `scripts/run.py:196-200`: ```python sim_str = f" (similarity: {sim:.2f})" if sim < 1 else "" lines.append(f"- **{r.get('id', '?')}** frame #{r.get('frame_id')} @ {r.get('frame_time', 0):.1f}s{sim_str}") lines.append(f" bucket: {r.get('bucket')}, blob: {r.get('blob')}") return "\n".join(lines) ``` ### Technical Analysis The image proxy is explicitly documented as requiring no client-side authentication and issuing access with no expiration. At the same time, image and keyframe formatters expose the underlying `bucket` and `blob` identifiers in normal command output. These identifiers therefore operate as permanent bearer references. They can be retained in agent transcripts, command output, app ...[truncated 1843 chars]- Remediation
View remediation