T09 · Insecure Skill Coding Practices
- Location
SKILL.md:76- Finding
Persistent Plaintext Logging of Potentially Sensitive Agent Communications
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 76–79
Vulnerability Type: Plaintext storage of potentially sensitive communication data
Risk Level: MediumVulnerable Code Snippet
English rendering of the complete relevant directive:
text All communication records are stored in: - `/root/.openclaw/agents/{agent_id}/communications/{date}.md`Technical Analysis
The Skill directs agents to persist all communications as Markdown files under the root user's OpenClaw state directory. The recorded messages may include task instructions, status reports, result details, internal file paths, error information, credentials, personal information, or other confidential task data.
The protocol does not specify data minimization, secret redaction, file permissions, encryption, retention limits, secure deletion, or restrictions on what may be written to the logs. It also uses attacker-influenced placeholders such as
{agent_id}without defining validation or canonicalization requirements. If an implementation inserts this value directly into a filesystem path, improper validation could additionally create a path-traversal or unintended-file-write risk, although no implementation demonstrating that behavior is present in the audited project.Attack Path
- An attacker or untrusted task originator includes a secret or other sensitive content in a task instruction.
- The agent handles the message according to the documented communication protocol.
- The directive to record all communications causes the sensitive message to be written in plaintext to the dated Markdown log.
- The content remains available beyond the original communication or task lifetime.
- A later process, administrator, compromised agent, backup reader, or other principal with access to the agent state directory retrieves the retained information.
This exploitation path does not provide code execution or privilege escalat ...[truncated 752 chars]
- Remediation
View remediation
Remediation Suggestions
- Log communication metadata by default, such as message type, timestamp, delivery state, and an opaque correlation identifier, rather than complete message bodies.
- Apply structured redaction before persistence, covering passwords, API keys, authentication tokens, private keys, session identifiers, personal data, and other configured sensitive patterns.
- Require explicit configuration or informed consent before storing full task instructions, results, or error payloads.
- Create log files with restrictive permissions, such as owner-only access, and ensure parent directories cannot be read or modified by unrelated users or agents.
- Validate
{agent_id}against a strict allowlist and reject path separators, traversal sequences, absolute paths, control characters, and symbolic-link redirections. - Resolve and verify the final canonical path before writing, ensuring it remains within the intended communications directory.
- Define short retention periods, automatic rotation, secure deletion procedures, and controls for backups containing communication logs.
- Encrypt sensitive retained records at rest with keys managed separately from the log directory.
- Document prohibited log content and provide a mechanism for callers to mark messages or fields as non-persistent.
- Add tests confirming that secrets are redacted, permissions are restrictive, path components cannot escape the intended directory, and expired records are deleted.