T09 · Insecure Skill Coding Practices
- Location
SKILL.md:20- Finding
Grafana Service-Account Token Exposed Through Command-Line Configuration
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 20–25
Vulnerability Type: Plaintext sensitive data in command-line arguments and configuration
Risk Level: MediumVulnerable Code
bash openclaw mcp set amg '{"url":"https://<your-grafana-instance>/api/azure-mcp","transport":"streamable-http","headers":{"Authorization":"Bearer <your-token>"}}'text Replace `<your-grafana-instance>` with your Azure Managed Grafana endpoint and `<your-token>` with a valid Grafana service-account token (starts with `glsa_`).Technical Analysis
The setup instructions require the user to substitute a live Grafana service-account token directly into a shell command. This exposes the bearer token in the command-line argument and may also cause it to be stored in plaintext by the MCP configuration mechanism.
Depending on the operating environment, the token may be recoverable from:
- Shell history files
- Process listings or endpoint-monitoring telemetry while the command executes
- Terminal session logs
- Shell-history synchronization services
- Diagnostic or support bundles
- The resulting OpenClaw MCP configuration file
A bearer token grants access based on possession. An attacker who obtains it does not need the original user's password or an additional cryptographic secret. The precise capabilities available to the attacker depend on the permissions assigned to the Grafana service account.
Attack Path
- A user follows the documented setup process and replaces
<your-token>with a valid Grafana service-account token. - The shell records the complete command in its history, or a local monitoring process captures the command-line arguments.
- The MCP registration mechanism may additionally persist the authorization header in a local configuration file.
- A local attacker, compromised process, history synchronization service, or diagnostic-data recipient retrieves the token.
- The attacker sends requests to the configured Azu ...[truncated 1020 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not place bearer tokens directly in shell command arguments.
- Obtain the token through a hidden interactive prompt, standard input, an operating-system credential store, or a supported secret-reference mechanism.
- If environment-variable substitution is unavoidable, ensure the tooling stores a secret reference rather than expanding and persisting the plaintext value.
- Store MCP credentials in a dedicated secrets backend or an encrypted credential file with permissions restricted to the owning user.
- Clearly document the location and protection requirements of any generated configuration file.
- Configure short token lifetimes and the minimum Grafana roles and datasource permissions necessary for the health check.
- Rotate any token that has already been entered literally into a shell command.
- Remove affected commands from shell history and review terminal logs, diagnostic bundles, and synchronized history for copies.
- Avoid printing authorization headers in verification output, debug logs, or error messages.
A safer conceptual setup flow is:
bash read -s -p "Grafana service-account token: " GRAFANA_TOKEN echo # Pass the token through a protected secret-input facility supported by OpenClaw. unset GRAFANA_TOKENThe implementation must ensure that the token is neither included in process arguments nor written as plaintext into ordinary configuration.