T05 · Unauthorized Access and Privilege Escalation
Note
- Location
- SKILL.md:6
- Finding
- Unnecessary Declaration of Memory and External Search Capabilities<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 6 **Vulnerability Type**: Excessive capability declaration and violation of least privilege **Risk Level**: Low ### Vulnerable Code ```yaml metadata: {"openclaw":{"emoji":"🎯","requires":["memory_search","tavily_search"]}} ``` ### Technical Analysis The Skill declares `memory_search` and `tavily_search` as required capabilities, but the audited implementation does not invoke either tool. The Python scripts use hard-coded local data, deterministic string templates, and console output. References to these tools in `scripts/opening.py` are only comments describing possible future functionality. Requesting `memory_search` is particularly unnecessary because it may give the Skill access to information retained from previous user interactions or sessions. Requesting `tavily_search` may unnecessarily enable outbound search requests. Granting either capability when it is not required violates the principle of least privilege and increases the consequences of a future code or instruction change. No active attempt to query memory, transmit information, or invoke external search was found in the audited version. ### Attack Path A conditional exploitation path exists if the hosting platform automatically grants every capability listed in the metadata: 1. A user installs or loads the Skill. 2. The host processes the `requires` declaration and makes `memory_search` and `tavily_search` available to the Skill. 3. The Skill consequently operates with capabilities beyond those needed for its current local question-generation behavior. 4. A later malicious modification, compromised update, or injected instruction could invoke `memory_search` to access retained information or use `tavily_search` as an outbound communication channel. 5. Information available through those tools could then be incorporated into generated output or external requests. The current package does not implement steps 4 or 5, so ...[truncated 612 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove both unused capabilities from the Skill metadata: ```yaml metadata: {"openclaw":{"emoji":"🎯"}} ``` 2. Add `tavily_search` only after implementing a feature that genuinely requires current external market data. 3. Do not request `memory_search` unless access to prior user context is essential to a clearly documented feature. 4. If either capability is introduced later: - Request explicit user consent before invoking it. - Restrict queries to the minimum information needed. - Never include credentials, confidential conversation data, or unrelated memory in external searches. - Clearly identify when generated content relies on external or retained information. - Apply host-level permission controls on every invocation rather than granting unrestricted access when the Skill loads. 5. Add tests or policy checks that fail when declared capabilities are not exercised by documented functionality. ]]>