T09 · Insecure Skill Coding Practices
Warning
- Location
README.md:149- Finding
API Key Exposed Through Command Arguments, Plaintext Configuration, and Diagnostic Output
- Content
View full analysis
> ~/.bashrc source ~/.bashrc ``` ```bash echo 'export ATTRIBULY_API_KEY="att_your_actual_key"' >> ~/.zshrc source ~/.zshrc ``` It also embeds the key directly in Docker configuration or process arguments: ```yaml services: openclaw: image: openclaw/openclaw:latest environment: - ATTRIBULY_API_KEY=att_your_actual_key ``` ```bash docker run -e ATTRIBULY_API_KEY=att_your_actual_key openclaw/openclaw:latest ``` The verification and troubleshooting instructions explicitly print or inspect the stored secret: ```bash openclaw config get skills.entries.attribuly-dtc-analyst.env.ATTRIBULY_API_KEY ``` ```bash cat ~/.openclaw/openclaw.json | grep -A 5 "attribuly-dtc-analyst" ``` Equivalent instructions are duplicated in the Japanese and Simplified Chinese README files at the locations listed above. ### Technical Analysis The documented setup procedures expose a long-lived authentication credential through several observable or insufficiently protected channels: 1. Passing the API key directly as a command argument can preserve it in shell history. Depending on the operating system and process-isolation settings, process arguments may also be observable by other local processes while the command runs. 2. Writing the key into `.bashrc` or `.zshrc` stores it as plaintext in a general-purpose startup file. The documentation does n ...[truncated 2934 chars]- Remediation
View remediation