T05 · Unauthorized Access and Privilege Escalation
Error
- Location
scripts/_auth.py:44- Finding
Cross-Skill Credential Access and Overwrite
- Content
View full analysis
Optional[str]: """From OPENCLAW_CONFIG_PATH read AK (fallback when Gateway has not restarted)""" if not OPENCLAW_CONFIG_PATH.exists(): return None try: with open(OPENCLAW_CONFIG_PATH, "r", encoding="utf-8") as f: config = json.load(f) entries = config.get("skills", {}).get("entries", {}) skill = entries.get("1688-shopkeeper", {}) ak = skill.get("apiKey") or skill.get("env", {}).get("ALI_1688_AK", "") return ak if ak else None ``` ```python # Unified path configuration for the Claw environment SKILL_NAME = "1688-shopkeeper" ``` ```python def configure_via_file(api_key: str) -> bool: """Directly write openclaw.json as a fallback.""" try: config: dict = {} if CONFIG_PATH.exists(): try: with open(CONFIG_PATH, "r", encoding="utf-8") as f: content = f.read().strip() if content: config = json.loads(content) except json.JSONDecodeError: return False config.setdefault("skills", {}) config["skills"].setdefault("entries", {}) config["skills"]["entries"].setdefault(SKILL_NAME, {}) skill_entry = config["skills"]["entries"][SKILL_NAME] skill_entry["apiKey"] = api_key if "env" in skill_entry and isinstance(skill_entry["env"], dict): skill_entry["env"].pop("ALI_1688_AK", None) if not skill_entry["env"]: del skill_entry["env"]) CONFIG_PATH.parent.mkdir(parents=True, exist_ok=True) with open(CONFIG_PATH, "w", encoding="utf-8") as f: ...[truncated 1754 chars]- Remediation
View remediation