T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/search-sessions.py:22
- Finding
- Private Conversation Excerpts and Potentially Mismatched API Credentials Sent to a Hard-Coded Provider## Vulnerability Details **File Location**: `scripts/search-sessions.py`, lines 22–40 and 108–133 **Vulnerability Type**: Provider-confusion flaw causing sensitive-data and credential disclosure **Risk Level**: High ### Vulnerable Code ```python def get_api_key(): """Find MiniMax/OpenAI API key from environment or OpenClaw config.""" # Try OpenClaw config try: cfg_path = os.path.expanduser("~/.openclaw/openclaw.json") with open(cfg_path) as f: config = json.load(f) # Check minimax provider in config providers = config.get("providers", {}) for p_name, p_cfg in providers.items(): for key_name in ("apiKey", "api_key"): if key_name in p_cfg: return p_cfg[key_name], p_name except Exception: pass # Env vars for var in ("MINIMAX_API_KEY", "OPENAI_API_KEY"): key = os.environ.get(var) if key: return key, var return None, None ``` ```python def summarize(query, results_text): """Summarize search results using MiniMax LLM.""" api_key, provider = get_api_key() if not api_key: return None, "⚠️ No API key found. Skipping summary." # MiniMax compatible OpenAI endpoint BASE_URL = "https://api.minimax.chat/v1" MODEL = "MiniMax-M2.7" prompt = f"""User asked: "{query}" Relevant conversation excerpts: --- {results_text} --- Briefly summarize whether these excerpts answer the user's question. Answer in Chinese, 1-2 sentences.""" payload = { "model": MODEL, "messages": [{"role": "user", "content": prompt}], "max_tokens": 300, "temperature": 0.3, } headers = { "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", } req = urllib.request.Request( f"{BASE_URL}/chat/completions", data=json.dumps(payload).encode("utf-8"), headers=headers, method="POST", ) `` ...[truncated 2419 chars]
- Remediation
- ## Remediation Suggestions 1. Bind each credential to its corresponding provider and endpoint. Never select the first arbitrary provider credential. 2. If MiniMax is the only supported service, accept only `MINIMAX_API_KEY` or an explicitly named MiniMax configuration entry. 3. If multiple providers are supported, derive the endpoint, model, and credential from one validated provider configuration object. 4. Reject unsupported providers and endpoint/credential mismatches instead of silently falling back. 5. Before transmission, display the destination hostname, provider, model, and categories of data being sent. 6. Require explicit confirmation before transmitting conversation excerpts, particularly on the first use of each provider. 7. Minimize the transmitted data by stripping session identifiers, tool commands, credentials, and unrelated text. 8. Add secret-detection and redaction before constructing the request. 9. Update the documentation to accurately state the endpoint used and the precise disclosure behavior. 10. Avoid returning remote HTTP response bodies directly to the terminal because they may expose unnecessary provider diagnostics.