T09 · Insecure Skill Coding Practices
Error
- Location
scripts/search-sessions.py:22- Finding
Private Conversation Excerpts and Potentially Mismatched API Credentials Sent to a Hard-Coded Provider
- Content
View full analysis
Vulnerability Details
File Location:
scripts/search-sessions.py, lines 22–40 and 108–133
Vulnerability Type: Provider-confusion flaw causing sensitive-data and credential disclosure
Risk Level: HighVulnerable Code
python def get_api_key(): """Find MiniMax/OpenAI API key from environment or OpenClaw config.""" # Try OpenClaw config try: cfg_path = os.path.expanduser("~/.openclaw/openclaw.json") with open(cfg_path) as f: config = json.load(f) # Check minimax provider in config providers = config.get("providers", {}) for p_name, p_cfg in providers.items(): for key_name in ("apiKey", "api_key"): if key_name in p_cfg: return p_cfg[key_name], p_name except Exception: pass # Env vars for var in ("MINIMAX_API_KEY", "OPENAI_API_KEY"): key = os.environ.get(var) if key: return key, var return None, Nonepython def summarize(query, results_text): """Summarize search results using MiniMax LLM.""" api_key, provider = get_api_key() if not api_key: return None, "⚠️ No API key found. Skipping summary." # MiniMax compatible OpenAI endpoint BASE_URL = "https://api.minimax.chat/v1" MODEL = "MiniMax-M2.7" prompt = f"""User asked: "{query}" Relevant conversation excerpts: --- {results_text} --- Briefly summarize whether these excerpts answer the user's question. Answer in Chinese, 1-2 sentences.""" payload = { "model": MODEL, "messages": [{"role": "user", "content": prompt}], "max_tokens": 300, "temperature": 0.3, } headers = { "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", } req = urllib.request.Request( f"{BASE_URL}/chat/completions", data=json.dumps(payload).encode("utf-8"), headers=headers, method="POST", ) `` ...[truncated 2419 chars]- Remediation
View remediation
Remediation Suggestions
- Bind each credential to its corresponding provider and endpoint. Never select the first arbitrary provider credential.
- If MiniMax is the only supported service, accept only
MINIMAX_API_KEYor an explicitly named MiniMax configuration entry. - If multiple providers are supported, derive the endpoint, model, and credential from one validated provider configuration object.
- Reject unsupported providers and endpoint/credential mismatches instead of silently falling back.
- Before transmission, display the destination hostname, provider, model, and categories of data being sent.
- Require explicit confirmation before transmitting conversation excerpts, particularly on the first use of each provider.
- Minimize the transmitted data by stripping session identifiers, tool commands, credentials, and unrelated text.
- Add secret-detection and redaction before constructing the request.
- Update the documentation to accurately state the endpoint used and the precise disclosure behavior.
- Avoid returning remote HTTP response bodies directly to the terminal because they may expose unnecessary provider diagnostics.