T09 · Insecure Skill Coding Practices
Error
- Location
scripts/soul-backup.sh:23- Finding
Plaintext credential backup is indiscriminately committed and pushed to Git
- Content
View full analysis
/dev/null; then echo "📋 Exporting OpenClaw config..." openclaw config get --json 2>/dev/null | python3 -c " import sys, json try: data = json.load(sys.stdin) parsed = data.get('result', {}).get('parsed', data) with open('$CONFIG_BACKUP', 'w') as f: json.dump(parsed, f, indent=2) print(' ✅ Config exported to $CONFIG_BACKUP') except Exception as e: print(f' ⚠️ Config export failed: {e}') " 2>/dev/null || echo " ⚠️ Config export skipped (openclaw not available)" fi # Stage all changes git add -A # Check if there are changes if git diff --cached --quiet; then echo "✅ No changes to backup" exit 0 fi # Commit MSG="${1:-backup: $(date +%Y-%m-%d_%H%M)}" git commit -m "$MSG" # Push echo "📤 Pushing to remote..." git push origin master 2>&1 || git push origin main 2>&1 ``` The corresponding documented procedure explicitly states that the exported file contains credentials and should be committed: ```markdown Use `gateway config.get` tool → extract the `parsed` object → write to a JSON file in the workspace (e.g. `openclaw-config-backup.json`). This step is critical — without this file, channel connections cannot be restored on a new instance. ### 3. Commit and push ```bash git add -A git commit -m "backup: $(date +%Y-%m-%d_%H%M)" git push origin master ``` ``` ### Technical Analysis The script obtains the complete parsed OpenClaw configuration, including channel tokens, API keys, environment variables, and runtime settings, and writes it to a plaintext JSON file. It does not: - Encrypt the exported data. - Restrict the file permissio ...[truncated 1806 chars]- Remediation
View remediation