T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/collect-data.py:331
- Finding
- Excessive Collection and Cloud Disclosure of Local Identity and Memory Content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/collect-data.py:331-333`; related data-flow instructions at `SKILL.md:121,137-139,252` **Vulnerability Type**: Excessive sensitive-data collection and disclosure **Risk Level**: Medium ### Vulnerable Code ```python return { 'recent_focus_fallback': get_recent_focus_fallback(), 'openclaw_review_fallback': '一个对 AI 有自己想法的人。', 'memory_bullets': get_memory_bullets(), # 以下为 AI 生成 comment/review 的完整素材 'user_md_excerpt': user_md[:2000] if user_md else '', 'identity_md_excerpt': identity_md[:1000] if identity_md else '', 'memory_md_excerpt': memory_md[:2000] if memory_md else '', 'stats_summary': { 'token_30d': token_30d_display, 'platforms': platforms, 'platform_count': len(platforms), 'skill_names': skill_names, 'skills_count': len(skill_names), }, } ``` The corresponding Skill instructions explicitly direct these excerpts into model context: ```text If the agent uses a cloud model, excerpt contents are sent to the model provider API. user_md_excerpt USER.md first 2000 characters identity_md_excerpt IDENTITY.md first 1000 characters memory_md_excerpt MEMORY.md first 2000 characters ``` ### Technical Analysis The data collector copies up to 5,000 characters of raw content from `USER.md`, `IDENTITY.md`, and `MEMORY.md` into the generated `copy_inputs` object. The Skill then instructs the agent to use all of this material when generating two relatively short card fields. Raw workspace excerpts can contain private identity details, long-term memories, unrelated personal information, or instructions embedded in stored text. The collection is based on fixed character limits rather than an allowlist of fields required for the card. Consequently, unrelated content within the beginning of these files may be included. When the agent uses a cloud-hosted model, this content is transmitted to the model provider as model context. T ...[truncated 1668 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace raw excerpts with locally extracted, explicitly allowlisted fields needed for the card. 2. Do not include `MEMORY.md` content by default. Require informed, per-run user confirmation before placing memory content into cloud-model context. 3. Provide a local-only mode that performs deterministic summarization without sending raw file content to a model. 4. Scan selected content for credentials, tokens, email addresses, private identifiers, and other sensitive patterns before model submission. 5. Limit model input to individually selected memory bullets rather than the first 1,000–2,000 characters of entire files. 6. Clearly delimit collected text as untrusted reference data and instruct the agent not to follow commands contained inside it. 7. Display the exact content that will be sent and the configured model destination before transmission. 8. Avoid retaining generated JSON files containing excerpts, and create temporary files with restrictive permissions when persistence is necessary. ]]>