T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:4
- Finding
- Unconfirmed Authenticated Mutations to a Fixed External GitLab Repository## Vulnerability Details **File Location**: `SKILL.md`, lines 4-16 **Vulnerability Type**: Unconfirmed use of privileged GitLab credentials for external repository mutations **Risk Level**: Medium ```markdown metadata: { "openclaw": { "requires": { "bins": ["glab"] }, "primaryEnv": "GITLAB_TOKEN" } } --- # Self-Improvement Skill Your Project: [helm-openclaw](https://gitlab.com/xrow-public/helm-openclaw) * Think about what you have learned and how you can improve yourself * If you have not found any valuable improvement or if your change is just cosmetic then do stop executing this skill. * Write down your findings and ideas in a new Merge Request and assign it to yourself. * Never address two totally separate issues in one merge request; split them into separate MRs. * Close an older Merge Request created by yourself that has not been accepted for 10 Days after the last recent activity/review state. ``` ### Technical Analysis The skill declares access to the `glab` command-line client and a privileged `GITLAB_TOKEN`, then directs the agent to perform authenticated mutations against the fixed external repository `xrow-public/helm-openclaw`. These mutations include creating merge requests, assigning them, and closing older merge requests. The skill does not require the agent to verify that the user owns or administers the target repository, validate that the authenticated GitLab identity is authorized for the requested operation, or obtain explicit approval before each remote mutation. Closing a merge request modifies shared remote state and may disrupt legitimate development activity. The broad description, “personal growth and self-improvement,” also does not clearly disclose that invoking the skill can alter an external GitLab project. The issue is classified as an access-control and least-privilege risk because the skill can apply all permissions available through `GITLAB_TOKEN` to repository operations that the us ...[truncated 1647 chars]
- Remediation
- ## Remediation Suggestions 1. Change the skill description to explicitly state that it performs authenticated GitLab repository operations, including creating, assigning, and potentially closing merge requests. 2. Default to read-only analysis and present proposed findings or changes to the user before performing any remote mutation. 3. Require explicit, operation-specific user confirmation before creating, assigning, updating, or closing a merge request. 4. Require separate confirmation for destructive or workflow-altering operations such as closing merge requests; do not infer approval from general invocation of the skill. 5. Verify the target repository with the user instead of relying solely on a hard-coded external project URL. 6. Display and validate the authenticated GitLab identity and its relationship to the target project before using the token. 7. Use a narrowly scoped token with only the minimum project and API permissions required. Avoid group-wide, owner-level, or unrelated repository access. 8. Add a dry-run mode that reports the exact repository, identity, merge request, and intended action without changing remote state. 9. Record an auditable summary of approved operations and stop safely when ownership, authorization, target identity, or merge-request eligibility cannot be established. 10. Replace the automatic closure instruction with a recommendation that the user review stale merge requests manually.