T09 · Insecure Skill Coding Practices
Error
- Location
- get_live_url.py:77
- Finding
- Bearer Credential Exfiltration Through Unrestricted Gateway Configuration and Optional TLS Bypass<![CDATA[ ## Vulnerability Details **File Location**: `get_live_url.py`, lines 77-99 **Vulnerability Type**: Unrestricted credential destination and optional TLS certificate verification bypass **Risk Level**: High ### Vulnerable Code ```python def get_api_host(env_vars): """ 获取网关地址：~/.openclaw/.env 中的 AI_GATEWAY_HOST，未配置则用默认值。 """ host = env_vars.get("AI_GATEWAY_HOST") return host.rstrip("/") if host else DEFAULT_API_HOST def get_verify_ssl(env_vars): """ 判断是否启用 TLS 证书验证。默认启用。 仅当 ~/.openclaw/.env 中显式设置 AI_GATEWAY_VERIFY_SSL=false 时禁用（仅开发环境）。 """ val = env_vars.get("AI_GATEWAY_VERIFY_SSL", "true").lower() return val not in ("false", "0", "no") def api_post(api_key, api_host, verify_ssl, path, body=None): """通用 POST 请求""" url = f"{api_host}{path}" headers = { "Content-Type": "application/json", "Authorization": f"Bearer {api_key}", } data = json.dumps(body).encode("utf-8") if body else b"" try: with httpx.Client(verify=verify_ssl, timeout=120.0, headers=headers) as client: resp = client.post(url, content=data) ``` ### Technical Analysis The persistent `AI_GATEWAY_HOST` setting is accepted without validating its scheme or destination against an allowlist. The script subsequently attaches the API key as a bearer credential to requests made to that configured destination. The same shared configuration file can set `AI_GATEWAY_VERIFY_SSL=false`, causing `httpx` to disable certificate verification. Consequently, the script does not enforce the documented trusted gateway as the credential recipient and does not guarantee an authenticated TLS channel. Although customization may be useful in development, allowing persistent shared configuration to control both the credential destination and TLS verification exceeds the minimum privileges required to query the declared Closeli API. The legitimate production operation only requires HTTPS communication with a k ...[truncated 1475 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enforce an explicit allowlist of trusted gateway hostnames, with `ai-open.icloseli.com` as the production destination. 2. Require the `https` scheme and reject URLs containing user information, fragments, unexpected ports, or untrusted hostnames. 3. Remove persistent support for `AI_GATEWAY_VERIFY_SSL=false`. 4. If development endpoints are necessary, require an explicit per-invocation development flag and prevent production API keys from being sent while verification is disabled. 5. Use a dedicated development credential with minimal privileges for non-production gateways. 6. Fail closed when gateway or TLS settings are malformed instead of silently accepting them. 7. Consider certificate pinning where operationally feasible. 8. Restrict `~/.openclaw/.env` to the service user with mode `0600` and prevent unrelated Skills from modifying it. ]]>