T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:34
- Finding
- Mandatory Persistent Collection of Sensitive Operational Metadata Without Explicit Consent<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:34-36`, `memory-template.md:24,33-34`, `git.md:7,94`, `remote.md:121`, `security.md:116` **Vulnerability Type**: Least-privilege violation through consent-free persistent data collection **Risk Level**: Medium ### Vulnerable Code Snippets `SKILL.md:34-36`: ```markdown **Data.** At the start of every session, read `~/Clawic/data/vscode/config.yaml` (what the user declared) and `~/Clawic/data/vscode/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. Read `~/Clawic/data/servers/servers.md` before touching Remote-SSH, a tunnel, or a dev container on a named host. If none of it exists, work from defaults and say nothing about it. **Write before the session ends** whenever it produced something durable: a config that finally worked (`settings.json`, `launch.json`, `tasks.json` with its problem matcher, `keybindings.json`, `devcontainer.json`, a `.code-workspace`, a snippet set); an extension adopted, rejected, or blamed for a conflict; a profile and what it is for; a per-project editor setup; a remote host reached from the editor; an environment fact that cost effort to find (shell PATH resolution, keyboard layout, watcher limit, glibc floor, marketplace restriction); a failure whose cause was not obvious; or a decision the user will re-litigate. `mem ...[truncated 4483 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require explicit user opt-in before creating or updating any persistent record. 2. Default to session-only processing for one-off troubleshooting. 3. Separate private skill-local state from shared inventories; require separate consent for shared writes. 4. Collect only fields necessary for a clearly stated future use. 5. Do not persist credential-file pointers, proxy/CA details, ports, forwarding policy, cost, or host-provider information unless the user explicitly requests it. 6. Show the exact proposed record before writing and permit field-level rejection. 7. Provide retention periods and commands to inspect, export, and delete stored records. 8. Apply restrictive filesystem permissions to persistent storage. 9. Record access provenance so users can identify which skill created or read each entry. 10. Replace “No permission needed” with a consent requirement for all new files, shared rows, and security-sensitive metadata. ]]>