T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- src/spawn/run.ts:34
- Finding
- Delegated CLI Agents Inherit the Complete Parent Process Environment<![CDATA[ ## Vulnerability Details **File Location**: `src/spawn/run.ts:34-38`, `src/providers/claude.ts:137-141`, `src/providers/opencode.ts:178-182` **Compiled Copies**: `bin/spawn/run.js:17-21`, `bin/providers/claude.js:105-109`, `bin/providers/opencode.js:148-152` **Vulnerability Type**: Excessive environment-variable exposure and violation of least privilege **Risk Level**: High ### Vulnerable Code Kimi provider: ```ts const child = spawn(kimiCmd, args, { cwd, env: { ...process.env, KIMI_NO_BROWSER: "1" }, stdio: ["pipe", "pipe", "pipe"], }); ``` Claude provider: ```ts const child = spawn(claudeCmd, args, { cwd, env: process.env, // Uses ANTHROPIC_API_KEY from environment stdio: ["pipe", "pipe", "pipe"], }); ``` OpenCode provider: ```ts const child = spawn(opencodeCmd, args, { cwd, env: process.env, stdio: ["pipe", "pipe", "pipe"], }); ``` ### Technical Analysis All supported delegated CLI agents receive the complete environment of the parent OpenClaw process. Provider authentication may require selected variables, such as `ANTHROPIC_API_KEY`, but passing every environment variable is not necessary for the declared task. The inherited environment can contain unrelated credentials, including cloud access keys, database passwords, CI/CD tokens, package registry tokens, internal service endpoints, and session secrets. The delegated tools are autonomous coding agents capable of invoking local commands. Consequently, any secret inherited by the subprocess may be inspected by commands generated during task execution. Using `spawn()` with an argument array prevents shell injection in the prompt, but it does not mitigate disclosure through an unnecessarily broad subprocess environment. This behavior exceeds the minimum privileges required to delegate a coding task. ### Attack Path 1. A user or upstream untrusted source supplies or influences a delegated coding prompt. 2. `cli-worker execute` starts Kimi, Claude Code, or OpenCode. 3 ...[truncated 1270 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Construct a minimal, explicit environment for each provider instead of forwarding `process.env`. 1. Allow only essential operating-system variables, such as: - `PATH` - `HOME` - `TMPDIR` - required locale variables - narrowly selected proxy or certificate variables when explicitly needed 2. Add only the authentication and configuration variables required by the selected provider: - Kimi-specific variables for Kimi - `ANTHROPIC_API_KEY` and documented Claude variables for Claude - documented OpenCode variables for OpenCode 3. Do not propagate unrelated variables matching sensitive patterns such as `*_TOKEN`, `*_SECRET`, `*_PASSWORD`, and unrelated `*_KEY` values. 4. Maintain separate provider allowlists and document every permitted variable. 5. Where supported, use provider credential files with restrictive permissions rather than broadly inherited environment credentials. 6. Add tests that place unrelated sentinel secrets in `process.env`, spawn each provider through a test executable, and verify that the sentinel variables are absent. ]]>