T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- config/shield.json:12
- Finding
- Default Policy Reads Security-Critical Files Beyond the Minimum OpenClaw Scope## Vulnerability Details **File Location**: `config/shield.json:12-17`, with the read operation implemented in `scripts/fileIntegrity.js:17-24` **Vulnerability Type**: Excessive access to sensitive system and SSH files **Risk Level**: Medium ### Vulnerable Code ```json "monitoredFiles": [ "~/.openclaw/openclaw.json", "~/.ssh/authorized_keys", "/etc/passwd", "/etc/sudoers" ], ``` The configured files are read by the following implementation: ```javascript function hashFile(filePath) { try { const content = fs.readFileSync(expandPath(filePath)); return crypto.createHash('sha256').update(content).digest('hex'); } catch (e) { return e.code === 'ENOENT' ? 'FILE_NOT_FOUND' : `ERROR:${e.code}`; } } ``` ### Technical Analysis The default policy causes the process to read OpenClaw authentication configuration, the current user's SSH authorization file, and system account or privilege configuration. Reading files to calculate integrity hashes is consistent with file-integrity monitoring, but monitoring SSH and operating-system authorization files is broader than the minimum access required to protect an OpenClaw agent. The implementation reads entire files into process memory rather than hashing them through a bounded stream. Consequently, any injected code, compromised dependency, debugger, crash reporter, or future logging change operating in the same process could access the full contents. The static warning that the Skill writes to `authorized_keys` is not confirmed. The reviewed implementation only reads that file and writes its SHA-256 hash to `data/baselines.json`. It does not add, remove, or modify SSH keys. The documentation also lists `~/.openclaw/credentials`, although it is not present in the shipped default `config/shield.json`. If a user follows the documented example, that credential store will also be read in full. ### Attack Path 1. The Skill is installed unde ...[truncated 1288 chars]
- Remediation
- ## Remediation Suggestions 1. Restrict the default list to OpenClaw files strictly required by the declared functionality. 2. Make SSH and operating-system file monitoring opt-in, with an explicit warning describing the required privileges and privacy implications. 3. Never recommend running the Skill as root solely to make otherwise inaccessible files readable. 4. Use streaming hashing through `crypto.createHash()` and `fs.createReadStream()` so entire files are not held in one process buffer. 5. Apply an allowlist or scope policy that prevents arbitrary sensitive paths from being added without explicit operator approval. 6. Reconcile `SKILL.md` with the shipped configuration, especially the inconsistent reference to `~/.openclaw/credentials`. 7. Document explicitly that `authorized_keys` is read-only and add tests confirming that no monitored target is opened with write permissions.