T09 · Insecure Skill Coding Practices
Note
- Location
references/apikey-fetch.md:15- Finding
Plaintext API Key Storage and Disclosure-Prone Configuration Verification
- Content
View full analysis
Vulnerability Details
File Location:
references/apikey-fetch.md, lines 15-38
Vulnerability Type: T09: Insecure Skill Coding Practices
Risk Level: LowVulnerable Code
markdown ### 2. Configure OpenClaw Edit the OpenClaw configuration file: `~/.openclaw/openclaw.json` Add or merge the following structure: ```json { "skills": { "entries": { "baidu-search": { "env": { "BAIDU_API_KEY": "your_actual_api_key_here" } } } } }Replace
"your_actual_api_key_here"with your actual API key.3. Verify Configuration
bash # Check JSON format cat ~/.openclaw/openclaw.json | python -m json.tooltext ### Technical Analysis The setup instructions direct users to store a live Baidu API key in plaintext within `~/.openclaw/openclaw.json`, but they do not instruct users to restrict that file's permissions. If the file is readable by other local accounts or processes, the credential may be recovered and reused. The recommended verification command also prints the entire configuration to standard output. Because the configuration may contain the Baidu key and unrelated OpenClaw credentials, this can expose secrets through terminal recording, command output capture, CI logs, support transcripts, or screen sharing. The executable itself does not print the API key. It uses the key as a Bearer credential over HTTPS to the declared Baidu endpoint, which is necessary for the Skill's stated search functionality. The weakness is limited to the credential-management guidance. ### Attack Path 1. A user follows the documented setup procedure and writes a valid `BAIDU_API_KEY` into `~/.openclaw/openclaw.json`. 2. The configuration file retains permissive permissions, or the user runs the documented verification command in a recorded or shared terminal. 3. Another local user, process, log reader, or recipient of the captured output obtains the plaintext API key. 4. The exposed credential is submitte ...[truncated 942 chars]- Remediation
View remediation
Remediation Suggestions
- Use the OpenClaw or operating-system secret store instead of embedding API keys directly in a general configuration file, where supported.
- If file-based storage is required, create and protect the configuration with owner-only permissions:
bash mkdir -p ~/.openclaw chmod 700 ~/.openclaw touch ~/.openclaw/openclaw.json chmod 600 ~/.openclaw/openclaw.json- Replace the disclosure-prone verification command with validation that suppresses parsed content:
bash python3 -c 'import json, pathlib; json.loads(pathlib.Path.home().joinpath(".openclaw/openclaw.json").read_text()); print("Configuration JSON is valid")'- Warn users not to paste full configuration files into issue reports, chat sessions, or logs. Provide a redaction procedure for troubleshooting.
- Recommend a narrowly scoped API credential, where Baidu supports scope restrictions, and document immediate revocation and rotation after suspected exposure.
- Ensure configuration backups and diagnostic bundles either exclude the file or redact credential values.