T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/user_profile.py:41- Finding
Automatic Overbroad Access to Global Agent Memory
- Content
View full analysis
Vulnerability Details
File Location:
scripts/user_profile.py:41-51,scripts/user_profile.py:59-123, andscripts/analyze_stock.py:192-201
Vulnerability Type: Excessive access to global Agent memory
Risk Level: MediumVulnerable Code
python def __init__(self): self.user_md_path = "/root/.openclaw/workspace/USER.md" def load_profile(self) -> UserProfile: """Load the user profile.""" if not os.path.exists(self.user_md_path): print("USER.md does not exist; using the default profile") return self.DEFAULT_PROFILE try: with open(self.user_md_path, 'r', encoding='utf-8') as f: content = f.read() return self._parse_user_md(content) except Exception as e: print(f"Failed to read USER.md: {e}; using the default profile") return self.DEFAULT_PROFILEThe stock-analysis workflow automatically enables this behavior:
python personalized_advice = generate_personalized_advice( code=code, name=name, quote=quote, financial=financial, analyst_results=analyst_results, final_vote=final_vote, final_score=final_score, user_profile=None, # Automatically loaded from USER.md graham_score=None )The resulting profile data is subsequently included in report output:
python lines.append(f"\nUser profile: {user_profile.name}") lines.append(f" Investment style: {user_profile.investment_style}") lines.append(f" Risk preference: {user_profile.risk_preference}") lines.append(f" Holding period: {user_profile.holding_period}") lines.append(f" Expected return: {user_profile.expected_return}%")Technical Analysis
The Skill reads the complete global OpenClaw
USER.mdfile whenever personalized stock advice is generated. It only needs a limited set of investment preferences, but it loads and scans the entire file, including potential ...[truncated 1646 chars]- Remediation
View remediation
Remediation Suggestions
- Replace access to the global
USER.mdwith a dedicated file such as~/.openclaw/workspace/investment/profile.json. - Require explicit opt-in before loading personalized information.
- Parse a strict schema containing only necessary fields:
- Investment style
- Risk preference
- Holding period
- Expected return
- Position and stop-loss limits
- Do not scan unrestricted profile text using broad keyword matching.
- Resolve the profile path through
os.path.expanduser()instead of hardcoding/root. - Avoid writing the user's name or other identifying information into reports unless explicitly requested.
- Apply restrictive permissions, such as mode
0600, to reports containing profile information. - Document the exact fields read, how they affect analysis, and where derived information is stored.
- Replace access to the global