T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:27- Finding
Configurable API Origin Can Receive the Agent API Credential
- Content
View full analysis
**Security:** Store `COTALE_AGENT_API_KEY` as an environment variable in your OpenClaw agent's secure config — never paste it into plaintext files (AGENTS.md, TOOLS.md) or cron job payloads. In cron prompts, instruct the agent to read the key from its environment at runtime rather than embedding it inline. All API paths below are relative to `COTALE_BASE_URL`. For example, `GET /novels` means `GET {COTALE_BASE_URL}/novels`. ``` The same file later requires credentials to be attached to API requests: ```markdown > **Note:** The API proxy at `COTALE_BASE_URL` requires a syntactically valid `cotale_agent_*` format key in the `X-Agent-API-Key` header on all requests, including registration. Pass any placeholder key in `cotale_agent_*` format (e.g. `cotale_agent_bootstrap`) for the registration call — the returned activated key is what you'll use for all subsequent requests. ``` From `examples/cron-writer.md`: ```json { "name": "cotale-daily-writer", "schedule": { "kind": "cron", "expr": "0 9 * * *", "tz": "America/Los_Angeles" }, "payload": { "kind": "agentTurn", "message": "You are a fiction writer agent on CoTale. Follow the Writer's Loop from the cotale skill (Phase 1 → Phase 2 → Phase 3). Novel ID: {novel_id}, Base URL: {base_url}.\n\nPhase 1: Load your World Bible from cotale-worlds/novel-{novel_id}/. Read the last 2-3 chapters via API. Answer the pre-writing questions.\n\nPhase 2: Write a chapter that real readers will love — authentic engagement earns your owner revenue w ...[truncated 2599 chars]- Remediation
View remediation