T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup_bot.py:42- Finding
OpenClaw configuration secrets are copied into files without enforced restrictive permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/setup_bot.py:42-55,scripts/setup_bot.py:76-105
Vulnerability Type: Plaintext sensitive-data storage with insecure file permissions
Risk Level: HighVulnerable Code
python def backup_config(self) -> bool: """Backup existing config""" if not self.config_path.exists(): print(f"\nℹ️ No existing config found at {self.config_path}") return True backup_path = self.config_path.with_suffix('.json.backup') try: with open(self.config_path, 'r') as f: config = json.load(f) with open(backup_path, 'w') as f: json.dump(config, f, indent=2) print(f"\n✅ Backed up existing config to {backup_path}") return Truepython def update_config(self, bot_token: str) -> bool: """Update OpenClaw config with Telegram settings""" print(f"\n📝 Updating OpenClaw configuration...") config = self.load_config() # Ensure telegram section exists if 'telegram' not in config: config['telegram'] = {} # Update telegram settings config['telegram'].update({ 'enabled': True, 'token': bot_token, 'pairing': True, 'streamMode': 'partial' }) # Ensure telegram plugin is enabled if 'plugins' not in config: config['plugins'] = [] if 'telegram' not in config['plugins']: config['plugins'].append('telegram') try: # Write updated config with open(self.config_path, 'w') as f: json.dump(config, f, indent=2)Technical Analysis
The setup script stores the Telegram bot token directly in
/home/openclaw/.openclaw/openclaw.json. It also copies the entire existing configuration into the predictable backup file/home/openclaw/.openclaw/openclaw.json.backup.Neither operation explicitly creates the destination with ...[truncated 1877 chars]
- Remediation
View remediation
Remediation Suggestions
- Create configuration and backup files with owner-only permissions:
python fd = os.open(path, os.O_WRONLY | os.O_CREAT | os.O_TRUNC, 0o600) with os.fdopen(fd, "w") as f: json.dump(config, f, indent=2) - Apply
os.chmod(path, 0o600)and verify that the file is owned by the expected OpenClaw account. - Confirm that
/home/openclaw/.openclawis not writable or traversable by unauthorized users. - Write updates to a securely created temporary file in the same directory, flush and synchronize it, set mode
0600, and atomically replace the destination withos.replace(). - Avoid copying the full configuration into an unprotected backup. If a backup is required, protect it identically to the primary configuration and document its secret-bearing nature.
- Prefer a secret manager, protected credential file, or environment-variable reference instead of embedding the token directly in JSON.
- Validate file type and ownership before overwriting either destination to reduce unsafe link or unexpected-file handling.
- Create configuration and backup files with owner-only permissions: