T09 · Insecure Skill Coding Practices
- Location
references/lifecycle-phase0.md:85- Finding
Overbroad Reading of Credential-Bearing Host Configuration
- Content
View full analysis
Vulnerability Details
File Location:
references/lifecycle-phase0.md:85-96, 138-146
Vulnerability Type: Sensitive configuration exposure through overbroad file access
Risk Level: MediumVulnerable Code
text Coordinator reads openclaw.json, parses all available AI models (provider/model-id format), and displays the model list to the user. File paths are attempted in this order: 1. ~/.openclaw/openclaw.json 2. ./openclaw.json 3. /etc/openclaw/openclaw.jsonjavascript // Coordinator pseudocode const config = JSON.parse(read("~/.openclaw/openclaw.json")); const availableModels = []; for (const provider of config.providers) { for (const model of provider.models) { availableModels.push({ id: `${provider.name}/${model.id}`, displayName: model.displayName, contextWindow: model.contextWindow, capabilities: model.capabilities }); } } displayModelList(availableModels);Technical Analysis
The workflow instructs the Coordinator to read an entire user-level, workspace-level, or system-level OpenClaw configuration file solely to enumerate model metadata. Such configuration files may also contain API keys, access tokens, passwords, provider secrets, endpoint credentials, or other sensitive values.
Although
SKILL.md:50states that credential fields must be filtered before configuration content is embedded in child-agent prompts, the Phase 0 procedure does not define or implement an allowlisted reader, trusted metadata API, or redaction step before the full configuration object is exposed to the Coordinator. Filtering only before child-agent dispatch does not prevent secrets from entering the Coordinator's context, tool traces, logs, telemetry, or error output.This is a least-data-access failure rather than evidence of intentional credential theft. No audited code was found that deliberately transmits these values to an external d ...[truncated 1272 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace direct reads of
openclaw.jsonwith a trusted host API that returns only non-sensitive model metadata. - If direct local parsing is unavoidable, perform it outside the model context and expose only an explicit allowlist:
provider.namemodel.idmodel.displayNamemodel.contextWindowmodel.capabilities
- Never return the raw configuration object through tool output or include it in Coordinator or child-agent prompts.
- Recursively redact keys matching credential patterns such as
apiKey,api_key,token,secret,password,credential,authorization, andprivateKey. - Ensure parse failures and debug logs report only the file path and a generic error, not file contents.
- Prefer manual model selection when the host cannot provide a safe metadata-only interface.
- Add tests using configuration fixtures containing nested credentials to verify that no sensitive values reach prompts, logs, traces, or displayed model lists.
- Limit configuration search locations to those explicitly authorized by the user or host environment rather than automatically probing system-level configuration.
- Replace direct reads of