T09 · Insecure Skill Coding Practices
- Location
scripts/setup-marketup-api-key.sh:16- Finding
API Key Stored in Plaintext Without Enforced Access Permissions
- Content
View full analysis
Vulnerability Details
File Location:
scripts/setup-marketup-api-key.sh:16-25
Related Invocation Locations:SKILL.md:11-13,references/setup-marketup-api-key.md:3-13
Vulnerability Type: Insecure credential storage and unsafe credential-file update
Risk Level: MediumVulnerable Code
bash mkdir -p "${ENV_DIR}" touch "${ENV_FILE}" if rg -q '^MARKETUP_API_KEY=' "${ENV_FILE}"; then sed -i.bak "s|^MARKETUP_API_KEY=.*$|MARKETUP_API_KEY=${MARKETUP_API_KEY_INPUT}|" "${ENV_FILE}" rm -f "${ENV_FILE}.bak" echo "MARKETUP_API_KEY has been updated in ${ENV_FILE}." else printf "MARKETUP_API_KEY=%s\n" "${MARKETUP_API_KEY_INPUT}" >> "${ENV_FILE}" echo "MARKETUP_API_KEY has been appended to ${ENV_FILE}." fiTechnical Analysis
The setup script persistently stores
MARKETUP_API_KEYas plaintext in~/.openclaw/.env. It creates the directory and file without explicitly enforcing restrictive permissions such as0700for the directory and0600for the file. Consequently, confidentiality depends on the invoking environment'sumaskand any pre-existing permissions or ownership.If the file or directory is readable by another local account or process, that principal can recover the credential. The Skill uses this credential as the
Authorizationheader for MarketUP CRM operations, including reading leads and accounts and performing mutations.The update branch also interpolates the credential directly into a
sedreplacement expression:bash sed -i.bak "s|^MARKETUP_API_KEY=.*$|MARKETUP_API_KEY=${MARKETUP_API_KEY_INPUT}|" "${ENV_FILE}"Replacement-sensitive characters in the key, including
&,|, and backslashes, are not escaped. Such characters can alter the replacement semantics, corrupt the saved value, or cause the update command to fail. This is not demonstrated as arbitrary shell-command execution because shell metacharacters introduced through variabl ...[truncated 1759 chars]- Remediation
View remediation
Remediation Suggestions
-
Set a restrictive
umaskbefore creating credential-bearing paths:bash umask 077 -
Create and enforce secure permissions:
bash mkdir -p -m 700 "${ENV_DIR}" touch "${ENV_FILE}" chmod 600 "${ENV_FILE}" -
Verify that the directory and file are owned by the current user and reject unexpected ownership.
-
Reject symbolic links and non-regular files before modifying
.envto prevent writes through an attacker-controlled path. -
Avoid interpolating the API key into a
sedexpression. Rewrite the file through a securely created temporary file while treating the credential as opaque data, then atomically replace the destination. -
Ensure the temporary file is created inside the protected directory with mode
0600, and install it atomically only after successful processing. -
Prefer the platform's dedicated secret-management facility instead of a plaintext environment file when such a facility is available.
-
After remediation, test keys containing
&,|, backslashes, spaces, and other special characters to ensure exact round-trip storage without interpretation.
-