T09 · Insecure Skill Coding Practices
Warning
- Location
references/chrome-relay-setup.md:8- Finding
Gateway Authentication Token Exposed in Terminal Output
- Content
View full analysis
gateway.auth.token ## Get Token ```bash cat ~/.openclaw/openclaw.json | grep -A5 auth ``` ``` ### Technical Analysis The setup guide instructs users to read the OpenClaw configuration file and print the authentication section, including five subsequent lines, to standard output. This can disclose the gateway authentication token and potentially adjacent sensitive configuration. Although the guide warns users not to paste the token into chat, the command itself still exposes sensitive values in the terminal. The output may be captured by terminal logging, shell-session recording, screen sharing, screenshots, CI logs, support transcripts, or clipboard-based troubleshooting. The broad `grep -A5 auth` selection may also reveal more data than the single required token. This is a sensitive-data handling weakness rather than automatic exfiltration: exploitation requires an attacker to obtain the exposed output or otherwise observe the terminal session. ### Attack Path 1. A user follows the documented setup procedure. 2. The user executes `cat ~/.openclaw/openclaw.json | grep -A5 auth`. 3. The gateway token and neighboring configuration are printed in plaintext. 4. The output is captured through terminal logging, screen sharing, screenshots, session recording, or troubleshooting material. 5. An attacker with access to that output extracts the gateway token. 6. If the attacker can reach the associated OpenClaw Gateway, the attacker attempts to authenticate with the disclosed token. 7. Successful authentication may permit use of gateway capabilities, including control of browser tabs that the user has exposed through the relay. ### Impact Assessment Disclosure of t ...[truncated 640 chars]- Remediation
View remediation