T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:42- Finding
Overbroad Access to Sensitive OpenClaw Configuration, Session Transcripts, and Logs
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 42, 53-58, 154, 185-211, and 226
Vulnerability Type: T05: Unauthorized Access and Privilege Escalation
Risk Level: MediumVulnerable Code
bash cat ~/.openclaw/openclaw.json 2>/dev/null | head -5 || echo "No OpenClaw config"bash cat ~/.openclaw/openclaw.json | python3 -c " import json, sys cfg = json.load(sys.stdin) plugins = cfg.get('plugins', {}).get('entries', {}) for name, p in plugins.items(): print(f'{name}: enabled={p.get(\"enabled\", \"?\")}') "bash cat ~/.openclaw/agents/main/sessions/<sessionId>.jsonlbash cat ~/.openclaw/agents/main/sessions/<id>.jsonl | python3 -c " import json, sys for line in sys.stdin: line = line.strip() if not line: continue msg = json.loads(line) t = msg.get('type','?') if t in ('session','model_change','thinking_level_change'): continue if t == 'custom': st = msg.get('customType','?') print(f' CUSTOM/{st}: {len(json.dumps(msg.get(\"data\",{}))):>6} chars') elif t == 'message': role = msg.get('message',{}).get('role','?') content = msg.get('message',{}).get('content','') if isinstance(content, list): for block in content: bt = block.get('type','?') if bt == 'text': print(f' {role:>12} text: {len(block.get(\"text\",\"\")):>6} chars | {block.get(\"text\",\"\")[:120]}') elif bt in ('tool_use','toolCall'): print(f' {role:>12} tool: {block.get(\"name\",\"?\")} | input: {len(json.dumps(block.get(\"input\",{}))):>6} chars') elif bt in ('tool_result','toolResult'): rc = block.get('content','') print(f' {role:>12} result: {len(str(rc)):>6} chars | {str(rc)[:120]}') "bash ...[truncated 3196 chars]- Remediation
View remediation
Remediation Suggestions
-
Use field-level configuration parsing. Read only plugin names and enabled states rather than displaying or loading unrelated configuration fields into Agent-visible output.
bash python3 -c " import json with open('$HOME/.openclaw/openclaw.json') as f: cfg = json.load(f) for name, plugin in cfg.get('plugins', {}).get('entries', {}).items(): print(name, bool(plugin.get('enabled', False))) " -
Default to metadata-only trace analysis. Calculate block types, character counts, token usage, and tool-call counts without printing transcript text, tool arguments, or tool results.
-
Require explicit consent for deep tracing. Before opening a transcript, identify the exact session and explain that it may contain private conversation and tool data. Proceed only after the user approves that specific access.
-
Apply automatic redaction. Remove authorization headers, API keys, bearer tokens, cookies, email addresses, and other secrets before placing data in Agent context or reports.
-
Constrain log collection. Filter by relevant error patterns and a narrow time range instead of reading the latest 300 lines indiscriminately. Avoid displaying complete lines when a count or event category is sufficient.
-
Separate collection from presentation. Ensure raw configuration, transcript, and log content is never copied directly into the final report. Present only aggregated statistics and sanitized excerpts.
-
Document data boundaries. State that optimization does not require credential values or complete conversation content and instruct the Agent to stop if such information is encountered.
-