T09 · Insecure Skill Coding Practices
Error
- Location
scripts/capabilities/configure/service.py:32- Finding
Plaintext Access Key Can Be Transmitted to an Environment-Controlled Endpoint
- Content
View full analysis
bool: try: import requests except ImportError: return False gateway_url = os.environ.get( "OPENCLAW_GATEWAY_URL", "http://localhost:18789" ) token = os.environ.get("OPENCLAW_GATEWAY_TOKEN", "") payload = { "skills": { "entries": { SKILL_NAME: { "apiKey": api_key } } } } try: headers = {} if token: headers["Authorization"] = f"Bearer {token}" resp = requests.patch( f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5 ) return resp.ok except Exception: return False ``` ### Technical Analysis The configuration function sends the complete plaintext access key in an HTTP request body. The destination is taken directly from the `OPENCLAW_GATEWAY_URL` environment variable without validating its scheme, host, port, or loopback status. Although the default destination is a local gateway, any process or execution environment capable of influencing this environment variable can redirect the request to an arbitrary remote endpoint. The implementation does not require HTTPS for remote destinations and does not verify that the endpoint represents the trusted OpenClaw gateway. This exceeds least-privilege requirements because configuring a local secret does not require permitting transmission to arbitrary hosts. ### Attack Path 1. An attacker, compromised launcher, malicious wrapper, or poisoned execution environment sets `OPENCLAW_GATEWAY_URL` to an attacker-controlled URL. 2. A user invokes `cli.py configure` with a valid ...[truncated 950 chars]- Remediation
View remediation