T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:353
- Finding
- Raw Credential Disclosure Through Recursive Configuration Audit Command## Vulnerability Details **File Location**: `SKILL.md`, line 353 **Vulnerability Type**: Sensitive information exposure **Risk Level**: Medium ### Vulnerable Code ```bash # Deep search for all API keys (for audit) jq '.. | objects | .apiKey? // .token? // .password? | select(.)' ~/.openclaw/config.json ``` ### Technical Analysis The documented `jq` command recursively searches the OpenClaw configuration for fields named `apiKey`, `token`, or `password` and writes their raw values to standard output. Displaying secret values is not required to establish whether credentials exist. The command therefore exceeds the minimum access and disclosure necessary for a configuration audit. When an AI agent executes it, the output may also enter the agent's context, session transcript, terminal capture, debug logs, monitoring systems, or other downstream tools. Although the Skill separately recommends environment-variable references, users may still have resolved or plaintext credentials in the configuration. The command does not redact, hash, or otherwise protect those values. ### Attack Path 1. A user has an API key, bot token, gateway token, or password stored in `~/.openclaw/config.json`. 2. The Skill is used to audit the configuration. 3. The agent follows the documented command at line 353. 4. `jq` recursively finds matching fields and prints their complete values. 5. The command output is captured in an agent transcript, terminal log, observability system, or another accessible context. 6. A party with access to that output obtains the credentials and reuses them against the associated services. This issue does not itself transmit credentials to an attacker-controlled endpoint, but it materially increases their exposure and creates a practical disclosure channel. ### Impact Assessment An exposed credential grants the permissions assigned to that credential. Depending on the configuration, the impact may include: - Unauthorized use of paid model-provider A ...[truncated 438 chars]
- Remediation
- ## Remediation Suggestions Replace the command with one that reports only matching configuration paths and never emits secret values: ```bash jq -r ' paths(scalars) as $p | select( ($p[-1] | tostring) | test("^(apiKey|token|password|botToken|appToken)$"; "i") ) | $p | map(tostring) | join(".") ' ~/.openclaw/config.json ``` Apply the following additional hardening measures: 1. Explicitly state that raw credentials must never be printed, logged, copied into agent context, or included in audit reports. 2. If value inspection is unavoidable, redact all but a minimal suffix and perform it only with informed user approval. 3. Prefer checking whether a secret is represented by an environment-variable reference rather than resolving or displaying it. 4. Avoid commands such as `openclaw config get --json` for secret auditing unless the tool guarantees redaction. 5. Ensure configuration and audit-output files use restrictive permissions such as `0600`. 6. Rotate any credential that has already appeared in command output, transcripts, or logs. 7. Add examples of safe audit output containing field paths and status indicators such as `present`, `missing`, or `uses environment reference`.