Security audit
Security checks for vulnerabilities and agentic risk
This API-key manager is mostly aligned with its purpose, but it includes unsafe key-handling bugs and Stripe payment scripts that deserve review before installation.
Review this skill carefully before installing. Use only test or restricted API keys until the scripts stop passing secrets in command-line arguments, sanitize AppleScript inputs, remove plaintext backups, and separate or disable the Stripe paid-tier scripts. Be aware that stored keys can be made available to other OpenClaw skills that request the same environment variable.
scripts/store_key_v4.sh:22AppleScript Injection Through an Unsanitized Service Name
scripts/store_key_v4.sh:101API Keys Passed as OpenClaw Command-Line Arguments
scripts/test_key_v5.sh:34Stored API Key Passed to Python Through the Process Argument Vector
paid_tier/stripe-checkout.sh:100Stripe Secret Key Exposed in Curl Command-Line Arguments
scripts/store_key_v3.sh:41Plaintext API Key Temporary Files and Backups Can Survive Storage Failures
SKILL.md:14Automatic Environment Injection Breaks Per-Skill Least Privilege
If the skill also performs audit/test-suite functions and optional live validation beyond direct key management, then its declared purpose is too narrow for its effective behavior. That matters because users may invoke it expecting local secret management only, while broader inspection or live API activity can expose sensitive data paths and expand attack surface.
If the skill also performs audit/test-suite functions and optional live validation beyond direct key management, then its declared purpose is too narrow for its effective behavior. That matters because users may invoke it expecting local secret management only, while broader inspection or live API activity can expose sensitive data paths and expand attack surface.
If the skill also performs audit/test-suite functions and optional live validation beyond direct key management, then its declared purpose is too narrow for its effective behavior. That matters because users may invoke it expecting local secret management only, while broader inspection or live API activity can expose sensitive data paths and expand attack surface.
If the skill also performs audit/test-suite functions and optional live validation beyond direct key management, then its declared purpose is too narrow for its effective behavior. That matters because users may invoke it expecting local secret management only, while broader inspection or live API activity can expose sensitive data paths and expand attack surface.
If the skill also performs audit/test-suite functions and optional live validation beyond direct key management, then its declared purpose is too narrow for its effective behavior. That matters because users may invoke it expecting local secret management only, while broader inspection or live API activity can expose sensitive data paths and expand attack surface.
If the skill also performs audit/test-suite functions and optional live validation beyond direct key management, then its declared purpose is too narrow for its effective behavior. That matters because users may invoke it expecting local secret management only, while broader inspection or live API activity can expose sensitive data paths and expand attack surface.
If the skill also performs audit/test-suite functions and optional live validation beyond direct key management, then its declared purpose is too narrow for its effective behavior. That matters because users may invoke it expecting local secret management only, while broader inspection or live API activity can expose sensitive data paths and expand attack surface.
If the skill also performs audit/test-suite functions and optional live validation beyond direct key management, then its declared purpose is too narrow for its effective behavior. That matters because users may invoke it expecting local secret management only, while broader inspection or live API activity can expose sensitive data paths and expand attack surface.
This script materially exceeds the declared purpose of an API-key-management skill by implementing paid-tier monetization logic and creating Stripe Checkout sessions. In an agent skill context, this scope expansion is dangerous because it introduces financial transaction capability, external side effects, and secret use that a user or reviewer would not reasonably expect from the stated functionality.
The script performs live external payment-processing actions unrelated to the stated key-management role, including creating Stripe Checkout sessions using a stored secret key. In the skill context, this is especially risky because it enables unexpected monetization actions and external network effects under the guise of credential management.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
echo "✅ Stripe key stored successfully!"
echo ""
echo "Next steps:"
echo " • Your key is now in openclaw.json (encrypted at rest by OS keychain)"
echo " • Skills can access it via STRIPE_SECRET_KEY env var"
echo " • Run: bash paid_tier/stripe-checkout.sh to test a checkout session"
echo ""
The script claims the key never appears in process listings, but it passes the raw API key as argv to a Python subprocess: python3 "$ _PYEOF_HDR" "$HFILE" "$KEY". On many systems, local users or monitoring tools can read process arguments via ps or /proc, exposing the secret. In a key-management skill, this contradiction is especially dangerous because users rely on the tool specifically to prevent key disclosure.
The inline comment states the key is never passed as a CLI argument to external tools, but the subsequent call passes $KEY directly to Python as a command-line argument. This creates a local secret exposure channel through process listings and diagnostic tooling. Because the skill's purpose is secure API key handling, this misimplementation undermines its core security guarantees.
Remote code is downloaded and executed. This bypasses code review and could introduce malicious code.
echo "$CONFIG_JSON" | python3 "$_PYEOF_HDR" "$HFILE" "$KEY"
rm -f "$_PYEOF_HDR"
# ── 5. Run curl ────────────────────────────────────────────────────────
RESP_FILE=$(mktemp)
START_MS=$(python3 -c "import time; print(int(time.time() * 1000))")
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
echo "--- SKILL.md security audit ---"
# T14: SKILL.md warns against echoing keys
echo "T14: SKILL.md has NEVER-echo rule"
if grep -qi "NEVER echo\|NEVER include.*key.*chat\|never.*print.*key" SKILL.md; then
pass "NEVER-echo rule documented"
else
Skill contains instructions that could directly expose system prompts, internal rules, or hidden instructions to users or external parties.
echo "--- SKILL.md security audit ---"
# T14: SKILL.md warns against echoing keys
echo "T14: SKILL.md has NEVER-echo rule"
if grep -qi "NEVER echo\|NEVER include.*key.*chat\|never.*print.*key" SKILL.md; then
pass "NEVER-echo rule documented"
else
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# T28: SERVICE_NAME sanitization — runtime test with dangerous input
echo "T28: SERVICE_NAME sanitization blocks dangerous chars at runtime"
DANGEROUS='Evil$(rm -rf /)'
SANITIZED=$(echo "$DANGEROUS" | sed 's/["`$;\\|&<>(){}]/_/g' | tr -s '_')
if echo "$SANITIZED" | grep -qE '[$`\\;|&<>(){}]'; then
fail "Dangerous chars survived sanitization: $SANITIZED"
Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).
# T28: SERVICE_NAME sanitization — runtime test with dangerous input
echo "T28: SERVICE_NAME sanitization blocks dangerous chars at runtime"
DANGEROUS='Evil$(rm -rf /)'
SANITIZED=$(echo "$DANGEROUS" | sed 's/["`$;\\|&<>(){}]/_/g' | tr -s '_')
if echo "$SANITIZED" | grep -qE '[$`\\;|&<>(){}]'; then
fail "Dangerous chars survived sanitization: $SANITIZED"
The README makes absolute claims like 'Keys never touch chat history, command arguments, or logs. Ever.' while later describing stdout handling and network-based validation. Even if the implementation is careful, absolute security guarantees in documentation are unsafe because they can cause operators to overtrust the tool and use it in contexts where stdout capture, agent logging, or remote API testing may expose secrets.
The README states or strongly implies that keys are not externally transmitted, but the documented 'test key' workflow sends the provided credential to the provider API for validation. This mismatch can mislead users into performing a network operation they may not expect, which matters because API keys are highly sensitive secrets and external transmission changes the trust and threat model.
The skill declares shell, file read/write, and environment-related capabilities through its documented behavior, but it does not declare an explicit tool scope or allowed-tools boundary. For a credential-management skill, this increases risk because the agent may invoke powerful primitives without a least-privilege contract, making accidental secret exposure, config tampering, or command misuse more likely.
Broad trigger phrases like 'manage keys' or 'set up API key' can cause the skill to activate in contexts where a user did not intend credential operations. For a secret-handling skill, accidental invocation is more dangerous than usual because it may prompt for, read, store, test, or mutate credentials and config unexpectedly.
The documentation claims keys never touch the network in the preferred flow, yet later instructs using those same keys in outbound curl requests to third-party APIs for testing. This is dangerous because users may rely on a strong confidentiality guarantee that is not universally true, leading to uninformed disclosure of credentials to external services.
The OpenAI test example sends the configured credential over the network to api.openai.com. This is expected for validation, but it remains a genuine external transmission of a secret and should be treated as such in a key-management skill.
## Testing a Key
Test endpoints:
- **OpenAI**: `curl -s -H "Authorization: Bearer $KEY" https://api.openai.com/v1/models | head`
- **ElevenLabs**: `curl -s -H "xi-api-key: $KEY" https://api.elevenlabs.io/v1/user`
- **Anthropic**: `curl -s -H "x-api-key: $KEY" -H "anthropic-version: 2023-06-01" https://api.anthropic.com/v1/messages -d '{"model":"claude-3-haiku-20240307","max_tokens":1,"messages":[{"role":"user","content":"hi"}]}'`
- **Brave Search**: `curl -s -H "X-Subscription-Token: $KEY" "https://api.search.brave.com/res/v1/web/search?q=test&count=1"`
The ElevenLabs test example transmits the API key to api.elevenlabs.io in an authentication header. This is a real exposure event to an external service and contradicts any blanket implication that keys remain strictly local.
Test endpoints:
- **OpenAI**: `curl -s -H "Authorization: Bearer $KEY" https://api.openai.com/v1/models | head`
- **ElevenLabs**: `curl -s -H "xi-api-key: $KEY" https://api.elevenlabs.io/v1/user`
- **Anthropic**: `curl -s -H "x-api-key: $KEY" -H "anthropic-version: 2023-06-01" https://api.anthropic.com/v1/messages -d '{"model":"claude-3-haiku-20240307","max_tokens":1,"messages":[{"role":"user","content":"hi"}]}'`
- **Brave Search**: `curl -s -H "X-Subscription-Token: $KEY" "https://api.search.brave.com/res/v1/web/search?q=test&count=1"`
No suspicious patterns detected.