T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/skill-health-check.mjs:99
- Finding
- Unrestricted Reading of Agent Session Transcripts<![CDATA[ ## Vulnerability Details **File Location**: `scripts/skill-health-check.mjs`, lines 8, 99–113, and 138–146 **Vulnerability Type**: Excessive access to potentially sensitive Agent session data **Risk Level**: Medium ### Vulnerable Code ```js const agentsRoot = '/Users/m1/.openclaw/agents'; function collectSessionFiles(dir) { const files = []; if (!fs.existsSync(dir)) return files; for (const entry of fs.readdirSync(dir, { withFileTypes: true })) { const full = path.join(dir, entry.name); if (entry.isDirectory()) { files.push(...collectSessionFiles(full)); } else if (full.endsWith('.jsonl')) { files.push(full); } } return files; } const sessionFiles = collectSessionFiles(agentsRoot); for (const file of sessionFiles) { const stat = fs.statSync(file); const lines = fs.readFileSync(file, 'utf8').split('\n').slice(-200); for (const line of lines) { if (!line) continue; for (const skill of skills) maybeUpdateUsage(skill, line, stat.mtimeMs); } } ``` ### Technical Analysis The health-check script recursively enumerates every `.jsonl` file under the hard-coded Agent directory and reads the most recent 200 lines of each file. Agent session transcripts may contain user conversations, tool responses, credentials, private data, filesystem paths, and other operational information. The stated purpose only requires determining whether a skill was recently used. Reading arbitrary transcript contents is broader than necessary and violates least-privilege and data-minimization principles. The directory is neither explicitly supplied by the user nor restricted to a dedicated usage-event store. The current implementation does not transmit transcript contents over the network or include them directly in its generated report. Nevertheless, the sensitive data is loaded into process memory, and the breadth of access increases the consequences of future defects, malicious modifications, logging changes, or runtime ...[truncated 1142 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Make transcript analysis explicitly opt-in rather than running it during every health check. 2. Replace the hard-coded Agent directory with a user-supplied, validated path. 3. Require the selected Agent data directory to reside within an approved filesystem boundary. 4. Prefer a dedicated usage-event index containing only skill identifiers and timestamps instead of parsing complete transcripts. 5. If transcript processing remains necessary: - Parse structured JSONL records and inspect only the required routing fields. - Stream records rather than loading complete file contents. - Enforce file-count, file-size, and recursion-depth limits. - Reject symbolic links or resolve real paths and verify that they remain inside the approved directory. - Avoid logging or persisting message contents. 6. Clearly document what session data is accessed, why it is needed, how much is read, and what is retained. 7. Run the analysis with a dedicated low-privilege account that cannot read unrelated Agent or user data. ]]>