T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- scripts/user_profile.py:41
- Finding
- Automatic Overbroad Access to Global Agent Memory## Vulnerability Details **File Location**: `scripts/user_profile.py:41-51`, `scripts/user_profile.py:59-123`, and `scripts/analyze_stock.py:192-201` **Vulnerability Type**: Excessive access to global Agent memory **Risk Level**: Medium ### Vulnerable Code ```python def __init__(self): self.user_md_path = "/root/.openclaw/workspace/USER.md" def load_profile(self) -> UserProfile: """Load the user profile.""" if not os.path.exists(self.user_md_path): print("USER.md does not exist; using the default profile") return self.DEFAULT_PROFILE try: with open(self.user_md_path, 'r', encoding='utf-8') as f: content = f.read() return self._parse_user_md(content) except Exception as e: print(f"Failed to read USER.md: {e}; using the default profile") return self.DEFAULT_PROFILE ``` The stock-analysis workflow automatically enables this behavior: ```python personalized_advice = generate_personalized_advice( code=code, name=name, quote=quote, financial=financial, analyst_results=analyst_results, final_vote=final_vote, final_score=final_score, user_profile=None, # Automatically loaded from USER.md graham_score=None ) ``` The resulting profile data is subsequently included in report output: ```python lines.append(f"\nUser profile: {user_profile.name}") lines.append(f" Investment style: {user_profile.investment_style}") lines.append(f" Risk preference: {user_profile.risk_preference}") lines.append(f" Holding period: {user_profile.holding_period}") lines.append(f" Expected return: {user_profile.expected_return}%") ``` ### Technical Analysis The Skill reads the complete global OpenClaw `USER.md` file whenever personalized stock advice is generated. It only needs a limited set of investment preferences, but it loads and scans the entire file, including potential ...[truncated 1646 chars]
- Remediation
- ## Remediation Suggestions 1. Replace access to the global `USER.md` with a dedicated file such as `~/.openclaw/workspace/investment/profile.json`. 2. Require explicit opt-in before loading personalized information. 3. Parse a strict schema containing only necessary fields: - Investment style - Risk preference - Holding period - Expected return - Position and stop-loss limits 4. Do not scan unrestricted profile text using broad keyword matching. 5. Resolve the profile path through `os.path.expanduser()` instead of hardcoding `/root`. 6. Avoid writing the user's name or other identifying information into reports unless explicitly requested. 7. Apply restrictive permissions, such as mode `0600`, to reports containing profile information. 8. Document the exact fields read, how they affect analysis, and where derived information is stored.