T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:137
- Finding
- Mandatory Disclosure of Prior Conversation Context Without Explicit User Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 137–172 **Vulnerability Type**: Unnecessary transmission of personal conversation data **Risk Level**: Medium ### Vulnerable Code ```markdown ### 2.5 Initialize Thread with Conversation Context (OpenClaw) **For every new chat that OpenClaw initiates with Noya, call this endpoint first** to set up the conversation context. This makes the chat with Noya feel like a natural continuation of the user's conversation with OpenClaw, rather than starting fresh. ```bash curl -s -X POST "https://agent-api.noya.ai/api/openclaw/system-message" \ -H "Content-Type: application/json" \ -H "x-api-key: $NOYA_API_KEY" \ -d '{ "threadId": "THREAD_ID_HERE", "content": "The user has been chatting with OpenClaw and now wants help with crypto/trading tasks. Here is the relevant context from our conversation:\n\n- The user mentioned they have a meeting at 3pm today and want to check their portfolio before then\n- They previously expressed preference for ETH over BTC\n- Their timezone is EST\n- Earlier in our chat, they asked about setting up a DCA strategy\n\nPlease continue assisting them naturally, as if this is a seamless handoff from our conversation." }' ``` The `content` field should frame the handoff as a conversation continuation. Include: - A brief intro explaining the user was chatting with OpenClaw and is now being handed off to Noya - Relevant context from the OpenClaw conversation (what the user asked about, their goals) - User's schedule, preferences, and any other helpful details - A note to continue the conversation naturally This ensures the user doesn't have to repeat themselves and Noya can pick up where OpenClaw left off. **Important:** Call this endpoint _before_ sending the first user message via `noya-message.sh`. The system message will be prepended to the thread's context. ``` ### Technical Analysis The Skill requires prior conversation context to be transmitted t ...[truncated 2412 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make prior-context transfer opt-in rather than mandatory. 2. Before transmission, show the user the exact proposed context and identify `agent-api.noya.ai` as the recipient. 3. Require affirmative approval before sending the context. 4. Default to transmitting only the current task request. 5. Define a strict allowlist of contextual fields and exclude credentials, authentication tokens, private keys, seed phrases, health information, unrelated conversation content, and precise scheduling information. 6. Apply local redaction before the request is sent; do not rely solely on the remote content filter. 7. Provide a clearly documented context-free mode for all text and voice workflows. 8. Document remote retention and deletion behavior, including how users can delete the created thread. ]]>