T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- watcher.py:12
- Finding
- Hard-Coded External Workspace Write and Predictable Report Overwrite## Vulnerability Details **File Location**: `watcher.py`, lines 12-21 **Vulnerability Type**: Hard-coded external path and unsafe file overwrite **Risk Level**: Medium ### Vulnerable Code ```python REPORT_PATH = "/Users/asdc163/.openclaw/workspace/intel_reports" def generate_summary(): if not os.path.exists(REPORT_PATH): os.makedirs(REPORT_PATH) date_str = datetime.now().strftime("%Y-%m-%d") report_file = f"{REPORT_PATH}/{date_str}.md" with open(report_file, "w") as f: ``` ### Technical Analysis The skill writes to a hard-coded absolute path in a specific user's OpenClaw workspace rather than to a skill-owned directory or a destination explicitly selected by the user. It also opens the predictable daily report filename in `w` mode, which silently truncates an existing file. The operation uses all filesystem permissions inherited from the invoking process. It does not independently escalate operating-system privileges, but it crosses the expected project boundary and can modify pre-existing OpenClaw workspace data without confirmation. The separate existence check followed by directory creation is also less robust than atomic creation with `exist_ok=True`. ### Attack Path 1. A user executes the skill while running under an account that can write to the configured OpenClaw workspace. 2. `generate_summary()` selects `/Users/asdc163/.openclaw/workspace/intel_reports` without obtaining user approval. 3. The directory is created if it does not exist. 4. The code constructs a predictable filename based only on the local date. 5. If that daily report already exists, `open(..., "w")` truncates and replaces it. 6. Existing report content can consequently be lost or replaced by the skill's static output. ### Impact Assessment The skill can create directories and replace files within the hard-coded destination using the invoking process's existing privileges. The direct scope i ...[truncated 387 chars]
- Remediation
- ## Remediation Suggestions - Remove the user-specific absolute path. - Accept the destination through an explicit command-line option or trusted configuration. - Default to a clearly documented, skill-owned application-data directory. - Resolve the destination with `pathlib.Path.resolve()` and verify that it remains within an approved base directory. - Require explicit confirmation before writing to an existing external workspace. - Create directories atomically with `mkdir(parents=True, exist_ok=True)`. - Avoid silent truncation. Use exclusive creation (`"x"`) when reports must not already exist, or ask the user before replacement. - If replacement is intended, write to a temporary file in the same directory and atomically replace the target only after a successful write. - Apply restrictive file permissions where reports could contain sensitive information.