Security audit

Credential Manager

Security checks for vulnerabilities and agentic risk

Overview

This credential-management skill is purpose-aligned and shows no exfiltration, but it broadly gathers, centralizes, backs up, and can delete sensitive secrets in ways that need careful Review before installation.

Install only if you intend to let this skill read and reorganize credentials across your account. Before running consolidation or cleanup, review the exact files it found, avoid --yes for sensitive migrations, protect or encrypt backups yourself, do not store wallet seed phrases or irreplaceable private keys unless you fully accept the risk, and do not delete originals until you have verified the new store and backups work.

A.I.G

Vulnerability Patterns

Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review

Findings (5)

T09 · Insecure Skill Coding Practices

Error

Location: scripts/consolidate.py:82
Finding: Plaintext Credential Backups Preserve Potentially Insecure Source Permissions
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/consolidate.py:201
Finding: Credential Store Is Written Non-Atomically Before Secure Permissions Are Applied
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Error

Location: scripts/cleanup.py:31
Finding: Cleanup Can Permanently Delete Credential Files Without Verifying Successful Migration
Content: View full analysis
Remediation: View remediation

T09 · Insecure Skill Coding Practices

Warning

Location: scripts/validate.py:28
Finding: Git-Ignore Protection Is Incorrectly Validated Through Substring Matching
Content: View full analysis
Dict: """Check if .env is in .gitignore.""" gitignore = openclaw_dir / '.gitignore' if not gitignore.exists(): return {'status': 'missing', 'message': '.gitignore does not exist'} content = gitignore.read_text() if '.env' in content or '*.env' in content: return {'status': 'ok'} else: return {'status': 'unprotected', 'message': '.env not in .gitignore'} ``` Equivalent substring logic is also used by `scripts/enforce.py:33-37` and `scripts/consolidate.py:239-244`. ### Technical Analysis The validator considers `.env` protected whenever the text `.env` occurs anywhere in `.gitignore`. This does not evaluate effective Git ignore semantics. False positives include: ```gitignore # Remember to protect .env !.env example.env ``` A comment, an unrelated filename, or an explicit negation can satisfy the substring test even when the target credential file is not ignored. Consolidation uses similar logic and may therefore decline to add a valid `.env` rule. ### Attack Path 1. The `.gitignore` file contains a comment mentioning `.env`, an unrelated matching filename, or an overriding `!.env` rule. 2. `check_gitignore()` finds the `.env` substring. 3. Validation and enforcement report that Git protection is active. 4. The user relies on the successful security result. 5. The plaintext centralized credential file is staged or committed. 6. Anyone with repository access or access to repository history obtains the credentials. ### Impact Assessment Exposure can include all credentials in the centralized store. If committed to a remote repository, the disclosure extends beyond the local system and can persist in Git history after the working-tree file is removed. The result ...[truncated 211 chars]
Remediation: View remediation

T05 · Unauthorized Access and Privilege Escalation

Warning

Location: scripts/scan.py:13
Finding: Default Credential Discovery Reads Broad Cross-Application Secret Locations
Content: View full analysis
Remediation: View remediation

SkillSpector

Vulnerability Patterns

Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
MCP Tool PoisoningHidden Instructions, Unicode Deception, Parameter Description Injection
Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (147)

Credential Access

High

Category: Privilege Escalation
Confidence: 84% confidence
Finding: Mandating a single plaintext .env as the only repository for all OpenClaw credentials centralizes every secret into one file. While centralization can simplify management, it also creates a high-value single point of compromise: access to that file grants access to all integrated services.
Content: Scanner excerpt · CONSOLIDATION-RULE.md (reported line 10)May include surrounding context.
There is exactly ONE location for all OpenClaw credentials:

text
~/.openclaw/.env

No exceptions. Not workspace, not skills, not scripts. Root only.

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The document explicitly instructs scanning ~/.config/*/credentials.json and similar files to collect secrets. Although credential handling is the stated purpose of the skill, broad discovery and aggregation of credential stores materially increases access to sensitive data and expands the blast radius if the process, backups, or destination file are compromised.
Content: Scanner excerpt · CONSOLIDATION-RULE.md (reported line 31)May include surrounding context.
md
- `~/.openclaw/workspace/skills/*/.env` ❌ → Root - `~/.openclaw/workspace/skills/*/repo/.env` ❌ → Root - `~/.openclaw/workspace/scripts/.env` ❌ → Root - `~/.config/*/credentials.json` ❌ → Root - Any scattered API key files ❌ → Root ## Enforcement

Credential Access

High

Category: Privilege Escalation
Confidence: 89% confidence
Finding: The enforcement section describes detecting all .env and credential files and merging them into a central location. Automated bulk collection of secrets is inherently sensitive and dangerous because it can unintentionally ingest unrelated credentials, duplicate stale secrets into backups, or expose all credentials through one migration pathway.
Content: Scanner excerpt · CONSOLIDATION-RULE.md (reported line 38)May include surrounding context.
md
The credential-manager skill enforces this rule: 1. **Scan:** Detects ALL .env files and credential files 2. **Consolidate:** Merges everything into `~/.openclaw/.env` 3. **Cleanup:** Removes scattered files (after backup) 4. **Validate:** Ensures no scattered files remain

Credential Access

High

Category: Privilege Escalation
Confidence: 93% confidence
Finding: The bash example tells developers to source ~/.openclaw/.env, which executes the contents of the file as shell code rather than safely parsing key-value pairs. If the .env file is modified maliciously or contains unexpected shell syntax, this can lead to arbitrary command execution in the developer's shell or script context.
Content: Scanner excerpt · CONSOLIDATION-RULE.md (reported line 83)May include surrounding context.
bash
#!/bin/bash # Load from root .env source ~/.openclaw/.env # Use credentials

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documentation repeatedly frames the skill as a complete consolidation and security workflow, but the reported implementation does not scan scattered sources, back up files, create the .env file, or perform actual migration. In a credential-management context, this is especially risky because inaccurate security tooling can cause operators to centralize trust in a process that does not protect or preserve their credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 97% confidence
Finding: The documentation repeatedly frames the skill as a complete consolidation and security workflow, but the reported implementation does not scan scattered sources, back up files, create the .env file, or perform actual migration. In a credential-management context, this is especially risky because inaccurate security tooling can cause operators to centralize trust in a process that does not protect or preserve their credentials.
Content: No source excerpt is available for this finding.

Tp4

High

Category: MCP Tool Poisoning
Confidence: 95% confidence
Finding: The documentation repeatedly frames the skill as a complete consolidation and security workflow, but the reported implementation does not scan scattered sources, back up files, create the .env file, or perform actual migration. In a credential-management context, this is especially risky because inaccurate security tooling can cause operators to centralize trust in a process that does not protect or preserve their credentials.
Content: No source excerpt is available for this finding.

Credential Access

High

Category: Privilege Escalation
Confidence: 88% confidence
Finding: The skill is explicitly designed to discover and process credential files such as credentials.json, which is highly sensitive behavior. Even if intended for legitimate migration, any agent granted this skill gains access to secrets across common directories, creating substantial confidentiality risk if the skill is misused, over-scoped, or compromised.
Content: Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.
md
The skill automatically detects credentials by scanning for: **File Patterns:** - `credentials.json` files in config directories - `.env` files - Memory files with `-creds` or `credentials` in the name

Credential Access

High

Category: Privilege Escalation
Confidence: 86% confidence
Finding: The skill explicitly targets highly sensitive material such as access tokens, passwords, private keys, and seed phrases. A tool that searches for and consolidates these artifacts carries elevated inherent risk, and any implementation flaw, overbroad permission, or deceptive behavior could expose extremely high-value secrets.
Content: Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.
md
- Memory files with `-creds` or `credentials` in the name **Sensitive Key Patterns:** - API keys, access tokens, bearer tokens - Secrets, passwords, passphrases - OAuth consumer keys - Private keys, signing keys, wallet keys

Credential Access

High

Category: Privilege Escalation
Confidence: 90% confidence
Finding: The documented scan targets broad filesystem patterns for credential files, including config directories and memory files. That broad discovery surface can expose unrelated secrets and increases the blast radius if the skill behaves incorrectly or if an attacker coerces the agent into running it in the wrong context.
Content: Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.
The skill scans these locations:

text
~/.config/*/credentials.json ~/.openclaw/workspace/memory/*-creds.json ~/.openclaw/workspace/memory/*credentials*.json ~/.env (if exists, merges)

Credential Access

High

Category: Privilege Escalation
Confidence: 85% confidence
Finding: The skill proposes merging an existing ~/.env into a centralized credential file, which can unintentionally ingest unrelated secrets from other applications. In a credential-management tool, this broad import behavior materially increases exposure and the chance of cross-application secret leakage.
Content: Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.
~/.config//credentials.json ~/.openclaw/workspace/memory/-creds.json ~/.openclaw/workspace/memory/credentials.json ~/.env (if exists, merges)

text
## Security Features

Credential Access

High

Category: Privilege Escalation
Confidence: 83% confidence
Finding: The example instructs other skills to import helper code from this skill to enforce and retrieve credentials. This creates a trust dependency where many other skills may gain a path to secret access through shared credential helper code, amplifying impact if that code is flawed or tampered with.
Content: Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.
md
# Add credential-manager scripts to path sys.path.insert(0, str(Path.home() / '.openclaw/skills/credential-manager/scripts')) # Enforce secure .env (exits if not compliant) from enforce import require_secure_env, get_credential require_secure_env()

Credential Access

High

Category: Privilege Escalation
Confidence: 76% confidence
Finding: The bash example directs skills to execute a Python enforcement script from a user-writable skill directory before handling credentials. Running executable code from that location creates a supply-chain and tampering risk, especially because successful execution becomes the gatekeeper for secret access.
Content: Scanner excerpt · SKILL.md (reported line 271)May include surrounding context.
md
#!/usr/bin/env bash set -euo pipefail # Validate .env exists and is secure if ! python3 ~/.openclaw/skills/credential-manager/scripts/enforce.py; then exit 1 fi

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: The bash example sources ~/.openclaw/.env directly, which executes shell-parsed content rather than safely parsing key-value pairs. If an attacker or malformed file places command substitutions or shell syntax in .env, sourcing can lead to arbitrary command execution in the caller's shell.
Content: Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.
fi

Now safe to load

source ~/.openclaw/.env

text
**This creates a fail-fast system:** If credentials aren't properly secured, skills refuse to run. Users are forced to fix it.

Credential Access

High

Category: Privilege Escalation
Confidence: 92% confidence
Finding: This shell example again instructs sourcing ~/.openclaw/.env, which treats credential data as executable shell input. In a secrets-management context, that is especially dangerous because a tampered .env can execute commands whenever downstream skills load credentials.
Content: Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.
Bash

bash
# Load .env set -a source ~/.openclaw/.env set +a

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/security.md (reported line 68)May include surrounding context.
Use Separate Credentials

bash
# Development ~/.openclaw/.env.development # Production ~/.openclaw/.env.production

Credential Access

High

Category: Privilege Escalation
Confidence: 60% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/security.md (reported line 71)May include surrounding context.
~/.openclaw/.env.development

Production

~/.openclaw/.env.production

Never mix environments

text

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CHANGELOG.md (reported line 81)May include surrounding context.
Social & Agent Networks

X (Twitter)

File patterns: x/credentials.json, twitter/credentials.json

Keys:

env

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · CORE-PRINCIPLE.md (reported line 13)May include surrounding context.
Social & Agent Networks

X (Twitter)

File patterns: x/credentials.json, twitter/credentials.json

Keys:

env

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 346)May include surrounding context.
Social & Agent Networks

X (Twitter)

File patterns: x/credentials.json, twitter/credentials.json

Keys:

env

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · SKILL.md (reported line 347)May include surrounding context.
Social & Agent Networks

X (Twitter)

File patterns: x/credentials.json, twitter/credentials.json

Keys:

env

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/supported-services.md (reported line 8)May include surrounding context.
Social & Agent Networks

X (Twitter)

File patterns: x/credentials.json, twitter/credentials.json

Keys:

env

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/supported-services.md (reported line 22)May include surrounding context.
Social & Agent Networks

X (Twitter)

File patterns: x/credentials.json, twitter/credentials.json

Keys:

env

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/supported-services.md (reported line 32)May include surrounding context.
Social & Agent Networks

X (Twitter)

File patterns: x/credentials.json, twitter/credentials.json

Keys:

env

Credential Access

High

Category: Privilege Escalation
Confidence: 70% confidence
Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
Content: Scanner excerpt · references/supported-services.md (reported line 42)May include surrounding context.
Social & Agent Networks

X (Twitter)

File patterns: x/credentials.json, twitter/credentials.json

Keys:

env

Static analysis

No suspicious patterns detected.

Overview

A.I.G

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T09 · Insecure Skill Coding Practices

T05 · Unauthorized Access and Privilege Escalation

SkillSpector

Credential Access

Credential Access

Credential Access

Credential Access

Tp4

Tp4

Tp4

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Credential Access

Now safe to load

Credential Access

Bash

Credential Access

Use Separate Credentials

Credential Access

Production

Never mix environments

Credential Access

Social & Agent Networks

X (Twitter)

Credential Access

Social & Agent Networks

X (Twitter)

Credential Access

Social & Agent Networks

X (Twitter)

Credential Access

Social & Agent Networks

X (Twitter)

Credential Access

Social & Agent Networks

X (Twitter)

Credential Access

Social & Agent Networks

X (Twitter)

Credential Access

Social & Agent Networks

X (Twitter)

Credential Access

Social & Agent Networks

X (Twitter)

Static analysis