T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:125
- Finding
- Unnecessary Requirement for Unrestricted Tool Profile## Vulnerability Details **File Location**: `SKILL.md:125` and `README.md:16` **Vulnerability Type**: Excessive permissions and violation of least privilege **Risk Level**: Medium **Relevant Code Snippets**: `SKILL.md:125` ```markdown - And ensure your OpenClaw **Tool Profile** is set to `full` ( Config -> Tools -> Tool Profile ) ``` `README.md:16` ```markdown 3. **Set Tool Profile**: You MUST set the tool profile to **full**. Without this, the skill cannot reach the Signalgrid API. ``` ### Technical Analysis The skill explicitly instructs users to enable OpenClaw's `full` tool profile. However, the reviewed implementation only requires execution of Node.js, access to the `SIGNALGRID_CLIENT_KEY` and `SIGNALGRID_CHANNEL` environment variables, and outbound HTTPS connectivity to `api.signalgrid.co:443`. No functionality in `signalgrid-activity.js` demonstrates a legitimate need for unrestricted shell, filesystem, or unrelated tool access. Requiring the broad profile therefore violates the principle of least privilege and expands the security boundary beyond the skill's stated notification-delivery purpose. Although the current script does not directly exploit these additional permissions, enabling them increases the possible impact of prompt injection, another compromised skill, or a malicious future update. ### Attack Path 1. A user follows the installation documentation and enables the `full` tool profile. 2. The agent receives access to tools beyond those needed to submit a Signalgrid notification. 3. Attacker-controlled instructions reach the agent through prompt injection, a compromised skill, or a malicious package update. 4. Those instructions invoke the unnecessarily exposed tools. 5. Depending on the tools available under the host's `full` profile, the attacker may access local files, execute commands, inspect sensitive resources, or perform actions unrelated to Signalgrid notifications. ### Impac ...[truncated 590 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the requirement to enable the unrestricted `full` tool profile from both `SKILL.md` and `README.md`. 2. Configure the narrowest available profile that permits only: - Execution of the bundled Node.js entry point. - Read access to `SIGNALGRID_CLIENT_KEY` and `SIGNALGRID_CHANNEL`. - Outbound TLS connections to `api.signalgrid.co` on port 443. 3. Deny access to unrelated shell commands, filesystem locations, credentials, integrations, and administrative tools. 4. If OpenClaw cannot express these restrictions, explicitly document the expanded privilege boundary and advise users to run the skill in an isolated, minimally privileged environment. 5. Apply outbound network allowlisting so the process can contact only the documented Signalgrid endpoint. 6. Run the OpenClaw process under a dedicated operating-system account without administrative privileges and with access only to files required by the skill.