T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/capabilities/configure/service.py:32
- Finding
- Plaintext Access Key Can Be Transmitted to an Environment-Controlled Endpoint<![CDATA[ ## Vulnerability Details **File Location**: `scripts/capabilities/configure/service.py:32-58` **Vulnerability Type**: Unrestricted credential transmission endpoint **Risk Level**: High ### Vulnerable Code ```python def configure_via_gateway(api_key: str) -> bool: try: import requests except ImportError: return False gateway_url = os.environ.get( "OPENCLAW_GATEWAY_URL", "http://localhost:18789" ) token = os.environ.get("OPENCLAW_GATEWAY_TOKEN", "") payload = { "skills": { "entries": { SKILL_NAME: { "apiKey": api_key } } } } try: headers = {} if token: headers["Authorization"] = f"Bearer {token}" resp = requests.patch( f"{gateway_url}/api/config", headers=headers, json=payload, timeout=5 ) return resp.ok except Exception: return False ``` ### Technical Analysis The configuration function sends the complete plaintext access key in an HTTP request body. The destination is taken directly from the `OPENCLAW_GATEWAY_URL` environment variable without validating its scheme, host, port, or loopback status. Although the default destination is a local gateway, any process or execution environment capable of influencing this environment variable can redirect the request to an arbitrary remote endpoint. The implementation does not require HTTPS for remote destinations and does not verify that the endpoint represents the trusted OpenClaw gateway. This exceeds least-privilege requirements because configuring a local secret does not require permitting transmission to arbitrary hosts. ### Attack Path 1. An attacker, compromised launcher, malicious wrapper, or poisoned execution environment sets `OPENCLAW_GATEWAY_URL` to an attacker-controlled URL. 2. A user invokes `cli.py configure` with a valid ...[truncated 950 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not accept an unrestricted gateway URL for credential configuration. 2. Permit only explicit loopback destinations such as `127.0.0.1`, `::1`, or a securely authenticated Unix-domain socket. 3. If remote gateways are required, enforce HTTPS, certificate verification, and an allowlist of trusted hostnames. 4. Require gateway authentication rather than making `OPENCLAW_GATEWAY_TOKEN` optional. 5. Reject URLs containing user information, redirects, unexpected paths, fragments, or nonapproved ports. 6. Disable redirects for the credential-bearing request. 7. Prefer passing a reference to a secret-manager entry instead of transmitting the raw AK. 8. Clearly report configuration failure without silently falling back after contacting an untrusted destination. ]]>