When /pair approve Bypasses the Scope Guard

A CVSS 9.9 privilege escalation vulnerability in OpenClaw's device pairing system where the /pair approve slash command bypasses scope authorization.

• •The core approveDevicePairing function enforces scope checks via an optional callerScopes parameter, rejecting callers without sufficient scope
• •The /pair approve slash command performs only a coarse scope check and calls approveDevicePairing without passing callerScopes
• •When callerScopes is absent, the core function skips enforcement, trusting the caller implicitly
• •An operator with only operator.pairing scope can approve a request granting operator.admin, completing full privilege escalation
• •The fix is 8 lines: pass callerScopes through the slash command path and add a corresponding test