T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/search.py:24- Finding
Overbroad Search of Credential-Bearing Environment Files
- Content
View full analysis
- Remediation
View remediation
Security audit
Irene Tavily Search
Security checks for vulnerabilities and agentic risk
Overview
This Tavily search skill mostly does what it says, but it needs Review because it reads API keys from broader .env locations than documented and gives weak plaintext key-storage guidance.
Install only if you are comfortable sending search queries to Tavily and using a Tavily API key. Prefer setting TAVILY_API_KEY only for the current session or storing it in a locked-down secret store; if you use ~/.openclaw/.env, make it owner-readable only. Review or remove the ~/.env and current-directory .env fallback behavior before using this in shared, sensitive, or multi-project environments.
Vulnerability Patterns
- Unauthorized Access and Privilege EscalationObtains permissions beyond the task's legitimate needs
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
Findings (2)
T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:35- Finding
Plaintext API-Key Storage Guidance Lacks Permission Hardening
- Content
View full analysis
> ~/.openclaw/.env ``` The documentation reinforces this recommendation at lines 128-129: ```markdown - The API key must be configured before first use - It is recommended to add the API key to ~/.openclaw/.env ``` ### Technical Analysis The documented shell command appends the Tavily API key to a plaintext file but does not create the parent directory securely, enforce restrictive permissions, or verify the permissions of an existing file. The resulting protection depends entirely on the user's current `umask` and any pre-existing permissions on `~/.openclaw/.env`. The value shown in the documentation is a placeholder rather than a hardcoded live credential. The vulnerability arises from unsafe secret-storage guidance, not from a credential committed to the project. Environment-file storage can be acceptable when the file is limited to the owning user. The current instructions omit that essential control and may cause users to persist real API keys in files readable by other local accounts or unintentionally include them in backups and copied configuration data. ### Attack Path 1. A user follows the documented command and stores a real Tavily API key in `~/.openclaw/.env`. 2. The file already has permissive permissions, or it is created under a permissive `umask`. 3. Another local user or process with access to the user's files reads the plaintext key. 4. The exposed key is used to submit Tavily requests, consume the account's quota, or generate activity attributed to the victim's account. Exploitation requires local file-read access or another mechanism that exposes the configuration file. The documentation itself does not transmit the k ...[truncated 575 chars]- Remediation
View remediation
> ~/.openclaw/.env ``` 3. Warn users not to commit `.env` files to version control, include them in shared archives, or expose them through logs. 4. Recommend checking existing permissions with `stat` and correcting them before writing a key. 5. Advise immediate credential revocation and rotation if the file may have been accessible to unauthorized users. 6. Where possible, provide a configuration command that writes the secret atomically and enforces owner-only permissions rather than instructing users to append it manually. ]]>
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Taint TrackingDirect Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
- MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
- Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
Findings (13)
Tainted flow: 'req' from os.environ.get (line 81, credential/environment) → urllib.request.urlopen (network output)
Critical
- Category
- Data Flow
- Confidence
- 90% confidence
- Finding
Credentials or environment variables flow to a network sink. This is a high-confidence indicator of credential exfiltration.
- Content
python method='POST' ) with urllib.request.urlopen(req, timeout=30) as response: result = json.loads(response.read().decode('utf-8')) return result
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 97% confidence
- Finding
The instruction to append TAVILY_API_KEY to ~/.openclaw/.env is credential persistence guidance that increases the chance of secret disclosure. In the context of a network-enabled search skill, exposure of the API key can allow unauthorized use of the user's Tavily account, quota consumption, and possible access to search activity associated with that key.
- Content
export TAVILY_API_KEY="tvly-..."
或者写入配置文件
echo 'TAVILY_API_KEY=tvly-...' >> ~/.openclaw/.env
text ## Usage
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 96% confidence
- Finding
Recommending in the Notes section that users add the API key to ~/.openclaw/.env reinforces insecure secret-at-rest handling without any safety warning. Repetition increases the likelihood that users will persist credentials in a broadly accessible location and overlook safer alternatives.
- Content
md ## Notes - 首次使用需要先配置TAVILY_API_KEY - 建议将API key添加到~/.openclaw/.env - 超过免费额度后会返回错误提示
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python if api_key: return api_key # Check .env file in common locations env_paths = [ os.path.expanduser('~/.openclaw/.env'), os.path.expanduser('~/.env'),
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # Check .env file in common locations env_paths = [ os.path.expanduser('~/.openclaw/.env'), os.path.expanduser('~/.env'), '.env' ]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # Check .env file in common locations env_paths = [ os.path.expanduser('~/.openclaw/.env'), os.path.expanduser('~/.env'), '.env' ]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python # Check .env file in common locations env_paths = [ os.path.expanduser('~/.openclaw/.env'), os.path.expanduser('~/.env'), '.env' ]
Credential Access
High
- Category
- Privilege Escalation
- Confidence
- 60% confidence
- Finding
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
- Content
python api_key = get_api_key() if not api_key: return { "error": "TAVILY_API_KEY not found. Please set it in environment or ~/.openclaw/.env" } # Build request payload
Undeclared Tool Scope
Medium
- Category
- MCP Least Privilege
- Confidence
- 91% confidence
- Finding
The skill documents capabilities that involve environment variables, reading local files, and making network requests, but it does not declare any explicit tool scope or permissions. That weakens least-privilege controls and makes it harder for users or a runtime to understand and constrain what the skill can access before execution.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The setup instructions recommend storing the API key in ~/.openclaw/.env without warning that this persists a credential on disk. Secrets written to local files can be exposed through weak filesystem permissions, backups, logs, accidental commits, or other local tooling that reads env files.
- Content
External Transmission
Medium
- Category
- Data Exfiltration
- Confidence
- 60% confidence
- Finding
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
- Content
python import urllib.error from datetime import datetime, timedelta TAVILY_API_URL = "https://api.tavily.com/search" def get_api_key(): """Get Tavily API key from environment or config file."""
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 92% confidence
- Finding
The script sends user search queries and the API key to a third-party service, but the code itself provides no explicit privacy or consent warning at the point of use. In an agent-skill context, users may submit sensitive prompts or internal data without realizing it will leave the local environment, creating a real data disclosure risk.
- Content
Natural-Language Policy Violations
Low
- Category
- Not specified by scanner
- Confidence
- 72% confidence
- Finding
Natural-language policy violations include forcing a specific language without user opt-in. The primary description is written in Chinese with embedded English, which may impose a language expectation on users without explicitly stating that documentation or usage guidance is available by user preference.
- Content