T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/generate.py:43- Finding
Overbroad Credential Discovery Can Transmit an Unrelated Secret to the GLM API
- Content
View full analysis
str | None: """Try env var → config files → .env files. Returns None if not found.""" value = os.environ.get(env_var) if value: return value config_paths = [ "config.json", os.path.expanduser("~/.openclaw/config.json"), os.path.expanduser("~/.claude/config.json"), ] for path in config_paths: if os.path.exists(path): try: with open(path) as f: data = json.load(f) if data.get(config_key): return data[config_key] except Exception: pass script_dir = os.path.dirname(os.path.abspath(__file__)) skill_dir = os.path.dirname(script_dir) env_paths = [ os.path.join(skill_dir, ".env"), ".env", os.path.expanduser("~/.env"), ] for path in env_paths: if os.path.exists(path): try: with open(path) as f: for line in f: line = line.strip() if line.startswith(f"{env_var}="): val = line.split("=", 1)[1].strip().strip('"') if val: return val except Exception: pass return None ``` The GLM loader supplies the generic configuration property name `api_key`: ```python def load_glm_key() -> str: key = _load_key_from_env_and_configs("GLM_API_KEY", "api_key") ``` The selected value is subsequently transmitted as an authorization credential: ```python def generate_image_glm( prompt: str, size: str = "10 ...[truncated 3583 chars]- Remediation
View remediation