T05 · Unauthorized Access and Privilege Escalation
Error
- Location
- SKILL.md:29
- Finding
- Unrestricted Cross-Agent Session Collection and External Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:29-41` and `SKILL.md:66-72` **Vulnerability Type**: Unauthorized access to private session data and external transmission **Risk Level**: High ### Vulnerable Instructions ```text **Directly read session JSONL files**: - Session path format: `/root/.openclaw/agents/{agent_id}/sessions/{session_id}.jsonl` - Locate the session file most recently modified today, using Beijing time - Parse the JSONL file and extract user messages **User-message extraction logic:** For each agent: 1. Locate JSONL files modified today under `/root/.openclaw/agents/{agent_id}/sessions/` 2. Read each file line by line and locate records with `type="message"` 3. Extract lines where `message.content[0].text` contains `"DM from ou_"` 4. Remove the `"DM from ou_xxx: "` prefix and retain the user's actual message 5. Deduplicate the messages and use them as the agent's work records ``` ```text ### 3. Save the Daily Report Save it to `/root/.openclaw/workspace/daily-report-YYYY-MM-DD.md` ### 4. Send to Feishu Use the `message` tool to send it to Feishu ``` ### Technical Analysis The skill instructs the agent to enumerate and directly read raw session files belonging to multiple agents. It extracts private direct-message content based only on file modification time and a message-prefix match. No authorization check, per-agent opt-in, user-consent verification, data classification, purpose limitation, or access boundary is defined. The collection scope can also expand beyond the statically listed team because the skill explicitly supports automatic discovery of new agents. Consequently, any account or process executing the skill with access to `/root/.openclaw/agents/` may aggregate conversations from a broader set of agents than is necessary for generating a work report. The extracted messages are then written to a plaintext Markdown file and transmitted through the Feishu messaging tool. The instructions do not require ...[truncated 2209 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace raw session-file scanning with a dedicated, structured work-log interface containing only reportable work items. 2. Require explicit opt-in for every agent and user whose content may be included in a report. 3. Enforce an authorization policy that limits the skill to approved agent IDs and explicitly prohibit automatic discovery unless an administrator authorizes it. 4. Avoid processing arbitrary direct-message text. Require users or agents to mark individual entries as reportable. 5. Apply data-loss-prevention filtering before storage or transmission, including detection and redaction of credentials, tokens, personal data, private URLs, and other sensitive material. 6. Generate a preview and require explicit user approval before sending the report externally. 7. Allowlist the Feishu tenant, chat, and recipient identifiers. Reject absent, dynamic, or unapproved destinations. 8. Store reports only when necessary, use restrictive file permissions such as owner-only access, and establish automatic retention and secure-deletion rules. 9. Record auditable metadata identifying the source agents, approval decision, destination, and redactions without logging the sensitive message bodies. 10. Run the skill under a dedicated low-privilege account that can access only approved work-log data rather than the entire `/root/.openclaw/agents/` hierarchy. ]]>