other
Warning
- Location
- scripts/dual_agent_solver.py:97
- Finding
- Potential Disclosure of Internal OpenBrain Context to an External Model Provider<![CDATA[ ## Vulnerability Details **File Location**: `scripts/dual_agent_solver.py`, lines 97-111 and 139-167 **Vulnerability Type**: Sensitive data exposure across a network trust boundary **Risk Level**: Medium ### Vulnerable Code ```python def maybe_openai_turn(system_role: str, prompt: str) -> str: key = os.environ.get("OPENAI_API_KEY") if not key: return openclaw_agent_turn(system_role, prompt) payload = { "model": os.environ.get("SOLVER_SECOND_MODEL", "gpt-4o-mini"), "messages": [ {"role": "system", "content": system_role}, {"role": "user", "content": prompt}, ], "temperature": 0.2, } headers = {"Authorization": f"Bearer {key}"} out = post_json("https://api.openai.com/v1/chat/completions", payload, headers=headers, timeout=90) return out["choices"][0]["message"]["content"].strip() ``` ```python # Optional context pull q = args.query.replace('\\', '\\\\').replace('"', '\\"') gql = 'query { searchDocs(query: "' + q + '", limit: 4) { nodes { ... on Guide { title href content } ... on CLICommandReference { title href content } } } }' ctx = mcp_call(docs_tool, {"graphql_query": gql}) context = extract_text(ctx.get("result"))[:6000] if ctx.get("ok") else "" solver_role = ( "You are Agent A (OpenClaw primary solver). Produce practical implementation plans with clear steps, tradeoffs, and rollback strategy." ) critic_role = ( "You are Agent B (adversarial reviewer). Find hidden risks, edge cases, missing assumptions, and force stronger plans." ) a_plan = "" b_crit = "" rounds = [] for i in range(1, max(1, args.rounds) + 1): a_prompt = ( f"Round {i}. Problem: {args.query}\n\n" f"Context:\n{context}\n\n" f"Previous critique:\n{b_crit}\n\n" "Output:\n1) Proposed solution\n2) Steps\n3) Risks\n4) Rollback" ) a_plan = openclaw_agent_t ...[truncated 3072 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit per-run opt-in before using an external provider, such as `--allow-external-model`. 2. Do not infer authorization solely from the presence of `OPENAI_API_KEY`. 3. Clearly disclose that the critic prompt may contain the user query and information derived from OpenBrain documents. 4. Keep the critic local by default, especially when OpenBrain context is enabled. 5. Add a mode that sends only a minimal, redacted plan summary to the external critic. 6. Scan outbound prompts for credentials, tokens, private keys, connection strings, personal information, internal hostnames, and other configured sensitive patterns. 7. Allow administrators to disable external processing globally or restrict it to approved models and endpoints. 8. Separate context retrieval from external processing. For example, require both `--include-openbrain-context` and `--allow-external-model` when both trust boundaries are involved. 9. Record whether external processing occurred, which provider and model received the data, and what categories of information were included, without logging sensitive content itself. 10. Document provider retention and privacy implications so operators can make an informed decision. ]]>