ClawHub
Back to skill

Security audit

Infisical Reader

Security checks for vulnerabilities and agentic risk

Overview

This skill does what it claims by reading Infisical secrets, but it can expose raw credentials too easily and lacks enough handling safeguards for such sensitive data.

Install only if you are comfortable giving an agent access to Infisical secrets. Use a tightly scoped machine identity, restrict it to specific projects/environments/paths, avoid --json and --raw unless absolutely necessary, assume output may be logged, and store or rotate the local client secret carefully.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (2)

T09 · Insecure Skill Coding Practices

Error
Location
scripts/infisical.py:128
Finding

JSON Output Discloses Complete Secret Values Without Explicit Raw-Output Authorization

Content
View full analysis
Remediation
View remediation

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/infisical.py:81
Finding

Default Masking Function Fully Reveals Short Secrets

Content
View full analysis
Remediation
View remediation

SkillSpector

Vulnerability Patterns
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Rogue AgentSelf-Modification, Session Persistence
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Findings (8)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/infisical.py (reported line 14)May include surrounding context.

python
def load_env():
    """Load INFISICAL_CLIENT_ID and INFISICAL_CLIENT_SECRET from ~/.openclaw/.env."""
    env_path = os.path.expanduser("~/.openclaw/.env")
    result = {}
    if os.path.exists(env_path):
        for line in open(env_path):

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · scripts/infisical.py (reported line 101)May include surrounding context.

python
def load_env():
    """Load INFISICAL_CLIENT_ID and INFISICAL_CLIENT_SECRET from ~/.openclaw/.env."""
    env_path = os.path.expanduser("~/.openclaw/.env")
    result = {}
    if os.path.exists(env_path):
        for line in open(env_path):

Credential Access

High
Category
Privilege Escalation
Confidence
85% confidence
Finding

This script authenticates to Infisical and retrieves an access token that is then used to enumerate projects and fetch raw secret values. In an agent-skill context, this materially increases risk because it gives the skill direct credential-access functionality and the ability to expose secrets to stdout, including unmasked output via --raw and full JSON output.

Content

Scanner excerpt · scripts/infisical.py (reported line 32)May include surrounding context.

python
def login(client_id, client_secret):
    """Authenticate and return access token."""
    url = "https://app.infisical.com/api/v1/auth/universal-auth/login"
    body = json.dumps({"clientId": client_id, "clientSecret": client_secret}).encode()
    req = urllib.request.Request(url, data=body, headers={"Content-Type": "application/json"})

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
88% confidence
Finding

The skill explicitly instructs the agent to read environment-backed credentials and call external REST endpoints, but it declares no tool/permission scope to constrain env or network access. In an agent ecosystem, this increases the blast radius by allowing a secret-reading skill to operate without transparent least-privilege boundaries, making accidental or unauthorized secret retrieval more likely.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
87% confidence
Finding

The skill is designed to fetch API keys and other credentials, yet its documentation provides no warning about the sensitivity of returned values, safe handling expectations, or prohibitions on logging/exposing secrets. In practice, operators or downstream agents may print, persist, or transmit raw secret material, turning normal use into credential disclosure.

Content

No source excerpt is available for this finding.

Session Persistence

Medium
Category
Rogue Agent
Confidence
76% confidence
Finding

The setup directs users to store long-lived machine identity credentials in a local plaintext env file under ~/.openclaw/.env, creating persistent authentication material on disk. If the local environment, backups, or adjacent tooling are compromised, an attacker can reuse those credentials to obtain short-lived access tokens and read secrets across granted projects.

Content

Scanner excerpt · SKILL.md (reported line 12)May include surrounding context.

md
## User Setup

1. Create Machine Identity: Organization → Access Control → Machine Identities.
2. Add Universal Auth to the identity → save Client ID + Client Secret.
3. Grant identity access to each project: Project Settings → Access Control → Identities → add as Member.
4. Store credentials in `~/.openclaw/.env`:

Missing User Warnings

Medium
Category
Not specified by scanner
Confidence
89% confidence
Finding

This markdown file documents endpoints that return raw secrets, including an example response containing a secret value, but it does not include any warning about the sensitivity of returned data or safe handling practices. For markdown files, missing warnings about behaviors that could affect privacy or sensitive data handling should be flagged.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Low
Category
Not specified by scanner
Confidence
83% confidence
Finding

The manifest describes a lightweight reader used to fetch API keys or credentials from Infisical, which implies secret retrieval. The code additionally implements project/workspace discovery via the workspace API and exposes it through --list-projects, expanding behavior beyond direct secret fetching.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.