other
Warning
- Location
SKILL.md:9- Finding
Broad Collection and Potential External Disclosure of Private Notification Content
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 9-16 and 28-46
Vulnerability Type: Privacy overcollection and potential disclosure
Risk Level: MediumVulnerable Code Snippet
text This Skill collects materials from two channels and combines them internally and externally: - **Internal signals**: Message notifications on users’ mobile phones (content platform push, industry group chat, team discussion, fan feedback) - **External hot spots**: Use `byted-web-search` to search for the latest industry trends, benchmark bloggers’ recent content, and hot topics on the track through the Internet Users set three types of attention dimensions through the installation pop-up window: - Who to follow: Benchmark bloggers, peer accounts, competing product creators, brand accounts or content sources that users clearly follow. - What to focus on: account tracks, content positioning, audience portraits, industry keywords (models, products, platforms, companies, technical directions, consumer trends, policy events, etc.). - Which groups and applications to pay attention to: monitored information source platforms and groups, such as Xiaohongshu, Bilibili, Jiji, official accounts, WeChat industry groups, creator groups, and internal team discussion groups.text ### Phase 1: Collect internal signals 1. To query notifications within a specified time range, use exec to execute: If the user does not provide the corresponding time, query notifications from yesterday to the current time: command: openclaw ntf search --from start time --to end time yieldMs: 30000 2. As long as the task involves "yesterday", "recent", "just now" and "latest notification", the query must be re-queried and the old results will not be reused. 3. Read the user's settings of who to follow, what to follow, and which groups and applications to follow; if the user does not provide it, the most likely filtering direction is inferred from the current request and notification ...[truncated 3532 chars]- Remediation
View remediation
Remediation Suggestions
- Require explicit, informed user consent before reading notification data, clearly identifying the sources and time range involved.
- Apply least-privilege retrieval controls directly in the notification query:
- Allowlist specific applications.
- Allowlist approved groups, accounts, or senders.
- Use the shortest necessary time interval.
- Exclude private and unrelated applications by default.
- Do not infer permission from notification context when configuration is absent. Ask the user to specify authorized sources instead.
- Filter and classify notification content locally before any external request is made.
- Remove names, handles, message text, organization identifiers, project names, and other personal or confidential information from derived search terms.
- Obtain separate confirmation before transmitting any notification-derived term to an external search provider.
- Prohibit external searches derived from internal team discussions, private messages, or other confidential channels unless expressly authorized.
- Add output controls that summarize trends without reproducing private message content or identifying third parties.
- Document retention, logging, deletion, and external-provider handling rules for notification-derived information.
- Record which approved sources contributed to each result so users can review the provenance and verify that collection stayed within scope.