T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/transcribe.sh:116
- Finding
- ElevenLabs API Key Disclosed in Debug Output<![CDATA[ ## Vulnerability Details **File Location**: `scripts/transcribe.sh:116-128` **Vulnerability Type**: Sensitive credential exposure through diagnostic logging **Risk Level**: High ### Vulnerable Code ```bash # Build curl command CURL_CMD=(curl -s -X POST "https://api.elevenlabs.io/v1/speech-to-text" \ -H "xi-api-key: $API_KEY") # Build form data FORM_DATA=(-F "model_id=$MODEL") FORM_DATA+=(-F "file=@$AUDIO_FILE") [[ -n "$LANGUAGE" ]] && FORM_DATA+=(-F "language_code=$LANGUAGE") [[ -n "$TIMESTAMPS" ]] && FORM_DATA+=(-F "timestamps_granularity=$TIMESTAMPS") FORM_DATA+=(-F "tag_audio_events=$TAG_AUDIO_EVENTS") # Debug if [[ -n "${DEBUG:-}" ]]; then log_info "curl ${CURL_CMD[*]} ${FORM_DATA[*]}" fi ``` ### Technical Analysis The `CURL_CMD` array contains the complete `xi-api-key` authentication header. When the `DEBUG` environment variable is non-empty, `${CURL_CMD[*]}` expands every array element and writes the plaintext API key to standard output. This debug mode is explicitly documented in `SKILL.md:307-312`, so users may reasonably enable it while troubleshooting. The exposed value can consequently enter terminal logs, OpenClaw execution transcripts, CI logs, monitoring systems, support tickets, or shared diagnostic output. The authenticated network request itself is necessary for the declared transcription functionality and targets the expected ElevenLabs API. The vulnerability is the unnecessary disclosure of the credential in diagnostic output. ### Attack Path 1. A user configures a valid `ELEVENLABS_API_KEY`. 2. The user follows the documented troubleshooting instructions and invokes `transcribe.sh` with `DEBUG=1`. 3. The script expands `CURL_CMD`, including `-H "xi-api-key: <secret>"`, and prints it. 4. The output is retained in an agent transcript, CI log, terminal capture, or support bundle. 5. An attacker who can read that output extracts the API key. 6. The attacker submits authenticated requests to ElevenLabs using the stolen ...[truncated 499 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Never expand or log command arrays containing authentication headers. 2. Replace the current debug message with a manually constructed, redacted representation: ```bash if [[ -n "${DEBUG:-}" ]]; then log_info "curl -s -X POST https://api.elevenlabs.io/v1/speech-to-text \ -H 'xi-api-key: [REDACTED]' ${FORM_DATA[*]}" fi ``` 3. Prefer logging only non-sensitive metadata, such as the endpoint, model, input basename, and whether optional fields are enabled. 4. Review all diagnostic output to ensure no secret environment variables, bearer tokens, cookies, or authentication headers are printed. 5. Add a regression test that runs the script with a synthetic API key and `DEBUG=1`, then fails if the key appears in captured output. 6. Update `SKILL.md` to state that debug output is sanitized and must not be used to expose request credentials. 7. Rotate any API key that may already have appeared in retained debug logs. ]]>