T05 · Unauthorized Access and Privilege Escalation
- Location
SKILL.md:5- Finding
Overprivileged Tool Access for a Chat Summarization Skill
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:5-19
Vulnerability Type: Excessive command-execution, filesystem, and cross-session permissions
Risk Level: MediumVulnerable Code
yaml metadata: openclaw: emoji: "💬📊" version: "2.0.0" requires: tools: ["message", "bash", "read", "write"] features: - "智能频道发现" - "定时纪要" - "实时监控" - "跨平台去重" - "多维度分析" - "行动项跟踪" - "AI 智能建议" - "摘要分级" allowed-tools: ["message", "bash", "read", "write", "sessions_send"]The intended use of these permissions is confirmed in
BUG_FIXES.md:179-187:markdown allowed-tools: ["message", "bash", "read", "write", "sessions_send"] - ✅ `message` - 用于读取聊天平台消息 - ✅ `bash` - 用于执行命令（如调用外部工具） - ✅ `read` - 用于读取文件 - ✅ `write` - 用于写入文件 - ✅ `sessions_send` - 用于跨会话通信（实时监控、定时纪要）Technical Analysis
The core purpose of the Skill is to read chat messages or imported files and produce summaries. The default permission set nevertheless includes:
bash, which permits arbitrary command execution.write, which permits filesystem modification.sessions_send, which permits communication across sessions.- Broad
readaccess without documented path restrictions.
These permissions exceed the minimum capabilities required for ordinary chat summarization. The documentation does not define command allowlists, filesystem scope restrictions, destination restrictions, or mandatory confirmation before invoking the privileged tools.
Chat content is inherently untrusted. If messages containing adversarial instructions are supplied to the model, excessive tool permissions increase the impact of successful indirect prompt injection. Although the audited project does not contain an explicit malicious prompt or executable payload, its privilege model unnecessarily exposes high-impact capabilities.
Attack Path
- An att ...[truncated 1277 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
bash,write, andsessions_sendfrom the default tool set. - Use only
messageand narrowly scoped file-reading capabilities for ordinary summaries. - Separate automation and integration features into explicitly enabled profiles with their own minimal permissions.
- Replace unrestricted Bash access with dedicated integration tools that validate arguments and enforce destination allowlists.
- Restrict file reads and writes to a dedicated workspace directory.
- Require explicit user confirmation before:
- Executing an external command.
- Writing or modifying a file.
- Sending information to another session or external service.
- Treat all imported chat messages as untrusted data and explicitly prohibit following instructions found inside summarized content.
- Apply host-level sandboxing, command allowlists, network egress controls, and comprehensive tool-call audit logging.
- Remove