T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- references/semantic-search.md:9
- Finding
- Read-only security claim conflicts with documented write and administrative operations<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:3-6, 91-103`; `references/semantic-search.md:9-31, 52-60`; `references/vector-search.md:6-23, 159-178`; `references/classic-patterns.md:207` **Vulnerability Type**: Least-privilege boundary violation and misleading security declaration **Risk Level**: High ### Evidence The skill declares itself read-only: ```yaml description: > Read-only Elasticsearch 9.x reference for AI-orchestrated search and analytics. SECURITY: This skill provides documentation for read-only operations only (search, aggregations, analytics). No write/update/delete operations are included. ``` It recommends a narrowly scoped API key: ```markdown - Scope API keys to specific indices and minimal privileges - For read-only OpenClaw access: `privileges: ["read", "view_index_metadata"]` ``` ```json POST /_security/api_key { "name": "openclaw-readonly", "role_descriptors": { "reader": { "indices": [{ "names": ["my-index"], "privileges": ["read"] }] } } } ``` However, the referenced setup instructions create an index and index a document: ```json PUT my-index { "mappings": { "properties": { "title": { "type": "text" }, "content": { "type": "text" }, "semantic_content": { "type": "semantic_text", "inference_id": "my-inference-endpoint" } } } } ``` ```json POST my-index/_doc { "title": "Fresh Broccoli", "content": "Nutritious green broccoli, rich in vitamins.", "semantic_content": "Fresh Broccoli Nutritious green broccoli, rich in vitamins. vegetables" } ``` They also create an inference endpoint containing an external-service credential: ```json PUT _inference/text_embedding/jina-embeddings-v3 { "service": "jinaai", "service_settings": { "api_key": "jina_xxxxxx", "model_id": "jina-embeddings-v3" } } ``` The vector-search reference creates another index, installs an ingest pipeline, and indexes a document through that pipeline ...[truncated 3835 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all index creation, document indexing, inference endpoint creation, ingest pipeline creation, and cluster-setting modification examples from the read-only skill. 2. Move setup and mutation examples into a separately named administrative guide that is not loaded during ordinary search tasks. 3. Correct the top-level description if mutation support is intentionally retained; do not describe the package as containing no write operations. 4. Document exact privileges for every operation and clearly separate: - Query-time credentials with `read` and narrowly required metadata access. - Provisioning credentials for index, inference, and pipeline setup. - Cluster-administration credentials for exceptional recovery work. 5. Never place provisioning or cluster-administration credentials in the normal agent workspace. Use a short-lived, separately stored credential and revoke it immediately after setup. 6. Require explicit user confirmation before presenting or executing any mutating request. 7. Scope all API keys to named indices and omit cluster privileges unless a separately reviewed administrative task strictly requires them. 8. Remove the persistent cluster-setting command from general troubleshooting or place it behind a prominent warning and administrator-only procedure. 9. Add automated documentation checks that reject `PUT`, document-indexing `POST`, pipeline creation, inference creation, and cluster-setting operations in files designated read-only. ]]>