T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:36
- Finding
- Unnecessary Default Access to Persistent Agent Memory## Vulnerability Details **File Location**: `SKILL.md`, lines 36–41 **Vulnerability Type**: Excessive access to persistent user and agent state **Risk Level**: Medium ### Vulnerable Code ```markdown 2. **Check local docs first** Prefer local docs before web docs: - `/Users/donzurbrick/.openclaw/workspace/docs` - `/Users/donzurbrick/.openclaw/workspace/AGENTS.md` - `/Users/donzurbrick/.openclaw/workspace/TOOLS.md` - `/Users/donzurbrick/.openclaw/workspace/MEMORY.md` ``` ### Technical Analysis The skill's default workflow instructs the agent to consult a user-specific persistent memory file before handling routine OpenClaw support requests. Persistent agent memory can contain private, conversation-derived, or otherwise unrelated information. This instruction violates least-privilege principles because most requests covered by the skill—such as configuration, commands, routing, gateway health, and channel troubleshooting—do not require access to long-term memory. Loading the file into the active context can expose unrelated private data to model processing and may allow that data to influence or appear in an answer. The reviewed content does not instruct the agent to modify the memory file, exfiltrate its contents, bypass operating-system permissions, or establish persistence. The finding is therefore limited to unnecessary read access and potential contextual disclosure. ### Attack Path 1. A user invokes the skill with an ordinary OpenClaw setup or troubleshooting request. 2. The agent follows the skill's default workflow. 3. The agent reads `/Users/donzurbrick/.openclaw/workspace/MEMORY.md`, despite the request not requiring persistent memory. 4. Unrelated private state enters the active model context. 5. The data may affect the diagnosis or be inadvertently included in a response. This path assumes the executing agent already has permission to read the referenced file; the skill itself does not grant or escalate operating-system privileges. ### Impact ...[truncated 628 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `MEMORY.md` from the default local documentation list. 2. Restrict persistent-memory access to requests explicitly involving memory behavior, stored user context, or memory-related diagnostics. 3. Require explicit user approval before reading persistent memory when it may contain sensitive or unrelated information. 4. Retrieve only the minimum relevant section instead of loading the entire file. 5. Redact credentials, personal data, and unrelated conversation-derived details before using retrieved content. 6. Revise the workflow to prioritize product documentation and the narrowly relevant configuration subtree: ```markdown 2. **Check local docs first** Prefer local product documentation before web documentation: - `/Users/donzurbrick/.openclaw/workspace/docs` - Relevant sections of `AGENTS.md` or `TOOLS.md`, only when required Do not inspect persistent memory unless the request explicitly concerns memory behavior and the user has approved that access. ``` 7. Document which information sources are appropriate for each troubleshooting lane so routine configuration and runtime requests cannot trigger broad access to persistent state.