Cxz9909 Credential Manager

• Outcome: Review
• Latest audit: Sep 16, 2026 · 7:17 AM UTC
• Version: 1.0.0

Overview

The skill is a real credential-management tool, but it should be reviewed carefully because it broadly centralizes secrets, deletes old credential files, and gives overbroad mandatory instructions with unsafe handling patterns.

Review before installing. Do not run auto-confirm or cleanup modes until you have inspected the exact files to be migrated, verified secure backups, and tested the new credential store. Avoid sourcing the generated .env in shell, avoid centralizing irreplaceable wallet seed phrases unless you deliberately accept that risk, and verify permissions, ownership, and git tracking with real filesystem and Git checks.

A.I.G

Vulnerability Patterns

• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (6)

T01 · Skill Instruction Hijacking

Error

• Location: SKILL.md:8

Finding

Mandatory Instructions Hijack Unrelated Agent Workflows

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/consolidate.py:87

Finding

Credential Backups Are Stored in Plaintext and May Retain Insecure Permissions

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/consolidate.py:208

Finding

Central Credential File Is Written Before Restrictive Permissions Are Applied

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/consolidate.py:102

Finding

Unescaped Credential Values Allow Dotenv Variable Injection

Content

View full analysis

Dict: """Load credentials from a file.""" if path.suffix == '.json': with open(path) as f: return json.load(f) elif path.name.endswith('.env'): creds = {} with open(path) as f: for line in f: line = line.strip() if '=' in line and not line.startswith('#'): key, val = line.split('=', 1) creds[key.strip()] = val.strip() return creds return {} ``` They are then inserted directly into the central file: ```python for service, items in sorted(services.items()): f.write(f"# {service}\n") for key, value in items: f.write(f"{key}={value}\n") f.write("\n") ``` ### Technical Analysis JSON values are serialized directly into dotenv syntax without escaping or validation. A string containing carriage returns or newlines can inject additional variables, comments, or malformed records. Non-string JSON values can also be converted into representations that are not valid or portable dotenv values. For example, a discovered JSON file could contain: ```json { "api_key": "expected-value\nSERVICE_ENDPOINT=https://attacker.example" } ``` The generated file would contain an additional `SERVICE_ENDPOINT` assignment. Downstream programs that source or parse the centralized file could then use the injected setting. This is a data-to-configuration injection flaw. It does not require command execution inside the migration script; exploitation occurs when another application trusts and consumes the resulting `.env` file. ### Attack Path 1. An attacker ...[truncated 1066 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/cleanup.py:14

Finding

Cleanup Deletes Files Without Proving Successful Migration or Backup

Content

View full analysis

List[Path]: """Find old credential files (excluding the new .env).""" from scan import scan_locations results = scan_locations() home = Path.home() env_file = home / '.openclaw' / '.env' old_files = [] for result in results: path = Path(result['path']) if path != env_file and path.exists(): old_files.append(path) return old_files ``` Scanner errors are conservatively classified as credentials: ```python except Exception as e: return { "path": str(path), "type": "json", "error": str(e), "likely_credentials": True, # Assume yes if can't read } ``` After textual confirmation, every resulting path is unlinked: ```python response = input(f"\n Type 'DELETE' to confirm: ") if response != 'DELETE': print(" ❌ Cancelled") return {'status': 'cancelled'} # Delete files deleted = [] errors = [] print(f"\n🗑️ Deleting files...") for f in old_files: try: f.unlink() deleted.append(f) print(f" ✅ Deleted: {f}") except Exception as e: errors.append((f, str(e))) print(f" ❌ Error: {f} - {e}") ``` ### Technical Analysis Cleanup does not consume a migration manifest and does not verify that each candidate was successfully parsed, merged, backed up, and tested. A malformed or unsupported file may be skipped by consolidation but still appear in a later cleanup scan. In particular, a JSON parsing error produces a result with `likely_credentials=True`. If the containing directory permits deletion, the file may be unlinkable even when its contents could not be read or ...[truncated 1429 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/enforce.py:32

Finding

Substring-Based Gitignore Checks Produce False Security Assurance

Content

View full analysis

bool: """Check if .env is git-ignored.""" gitignore = Path.home() / '.openclaw' / '.gitignore' if not gitignore.exists(): return False return '.env' in gitignore.read_text() ``` The validator uses similarly broad matching: ```python def check_gitignore(openclaw_dir: Path) -> Dict: """Check if .env is in .gitignore.""" gitignore = openclaw_dir / '.gitignore' if not gitignore.exists(): return {'status': 'missing', 'message': '.gitignore does not exist'} content = gitignore.read_text() if '.env' in content or '*.env' in content: return {'status': 'ok'} else: return {'status': 'unprotected', 'message': '.env not in .gitignore'} ``` ### Technical Analysis The code does not evaluate Git ignore semantics. Any occurrence of the substring `.env` is accepted, including: ```gitignore .env.example # Remember to ignore .env later !.env ``` None of these examples necessarily protects the target credential file. A negated rule can explicitly re-include it, while an existing tracked file remains tracked even after a valid ignore rule is added. The enforcement function may therefore report that all security checks passed while Git can still stage or commit the central credential file. ### Attack Path 1. The `.gitignore` contains `.env.example`, a comment mentioning `.env`, or a negated `!.env` rule. 2. `check_gitignore()` finds the substring `.env`. 3. Validation and enforcement report that the credential file is protected. 4. The user relies on the successful result. 5. The central `.env` is staged or remains tracked. 6. Credentials are committ ...[truncated 505 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (149)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 94% confidence

Finding

The bash example source ~/.openclaw/.env encourages executing the contents of the .env file as shell code. If that file is modified maliciously or contains unexpected shell syntax, sourcing it can trigger command execution rather than merely loading key-value pairs.

Content

Scanner excerpt · CONSOLIDATION-RULE.md (reported line 83)May include surrounding context.

bash

#!/bin/bash
# Load from root .env
source ~/.openclaw/.env

# Use credentials

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

This snippet combines sourcing a credential file with immediately echoing a secret, creating both code-execution risk and direct secret disclosure risk. In a credential-management skill, such guidance is especially dangerous because users are likely to copy-paste it while handling sensitive production tokens.

Content

Scanner excerpt · CONSOLIDATION-RULE.md (reported line 84)May include surrounding context.

bash

#!/bin/bash
# Load from root .env
source ~/.openclaw/.env

# Use credentials
echo "$SERVICE_API_KEY"

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 95% confidence

Finding

If the skill only validates an existing ~/.openclaw/.env and perhaps fixes limited metadata, then calling it a mandatory migration and consolidation foundation is materially misleading. The risk is amplified because the content repeatedly frames itself as non-optional and authoritative, encouraging users to trust it without independent verification.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the skill only validates an existing ~/.openclaw/.env and perhaps fixes limited metadata, then calling it a mandatory migration and consolidation foundation is materially misleading. The risk is amplified because the content repeatedly frames itself as non-optional and authoritative, encouraging users to trust it without independent verification.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 92% confidence

Finding

If the skill only validates an existing ~/.openclaw/.env and perhaps fixes limited metadata, then calling it a mandatory migration and consolidation foundation is materially misleading. The risk is amplified because the content repeatedly frames itself as non-optional and authoritative, encouraging users to trust it without independent verification.

Content

No source excerpt is available for this finding.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 96% confidence

Finding

If the skill only validates an existing ~/.openclaw/.env and perhaps fixes limited metadata, then calling it a mandatory migration and consolidation foundation is materially misleading. The risk is amplified because the content repeatedly frames itself as non-optional and authoritative, encouraging users to trust it without independent verification.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 81% confidence

Finding

The top-level description announces consolidation of API keys and credentials into a single .env, which is a sensitive operation with direct access to secrets. The risk comes from centralizing many credentials into one target without strong guarantees around scope, implementation fidelity, and safe handling.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md

---
name: credential-manager
description: MANDATORY security foundation for OpenClaw. Consolidate scattered API keys and credentials into a secure .env file with proper permissions. Use when setting up OpenClaw, migrating credentials, auditing security, or enforcing the .env standard. This is not optional — centralized credential management is a core requirement for secure OpenClaw deployments. Scans for credential files across common locations, backs up existing files, creates a unified .env with mode 600, validates security, and enforces best practices.
---

# Credential Manager

Credential Access

High

• Category: Privilege Escalation
• Confidence: 79% confidence

Finding

Mandating a single ~/.openclaw/.env as the only credential store creates a concentration-of-secrets pattern. While centralization can simplify administration, it also makes compromise of one file disproportionately damaging and may not fit all threat models.

Content

Scanner excerpt · SKILL.md (reported line 26)May include surrounding context.

Every OpenClaw deployment MUST have:

text

~/.openclaw/.env (mode 600)

This is your single source of truth for all credentials. No exceptions.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

The skill explicitly targets credential files such as credentials.json and secret-bearing patterns for scanning and consolidation. Access to such files is inherently high risk, and in this case the danger is elevated by the lack of clearly bounded permissions and the possible mismatch between claimed and actual safeguards.

Content

Scanner excerpt · SKILL.md (reported line 55)May include surrounding context.

md

The skill automatically detects credentials by scanning for:

**File Patterns:**
- `credentials.json` files in config directories
- `.env` files
- Memory files with `-creds` or `credentials` in the name

Credential Access

High

• Category: Privilege Escalation
• Confidence: 80% confidence

Finding

The skill targets highly sensitive secret classes including access tokens, passwords, private keys, and seed phrases. That scope is inherently dangerous and requires especially strong containment, explicit consent, and minimal-retention design; otherwise the skill becomes a high-value path to aggregate the user's most sensitive assets.

Content

Scanner excerpt · SKILL.md (reported line 60)May include surrounding context.

md

- Memory files with `-creds` or `credentials` in the name

**Sensitive Key Patterns:**
- API keys, access tokens, bearer tokens
- Secrets, passwords, passphrases
- OAuth consumer keys
- Private keys, signing keys, wallet keys

Credential Access

High

• Category: Privilege Escalation
• Confidence: 87% confidence

Finding

The documented scan paths include broad globs over configuration and memory directories plus a home-directory .env, which can sweep up unrelated secrets. Broad credential discovery is dangerous in agent contexts because it expands the blast radius of accidental leakage, misuse, or destructive cleanup.

Content

Scanner excerpt · SKILL.md (reported line 107)May include surrounding context.

The skill scans these locations:

text

~/.config/*/credentials.json
~/.openclaw/workspace/memory/*-creds.json
~/.openclaw/workspace/memory/*credentials*.json
~/.env (if exists, merges)

Credential Access

High

• Category: Privilege Escalation
• Confidence: 86% confidence

Finding

Including ~/.env in merge targets broadens collection into a common user-level secret store that may contain unrelated credentials. That increases the chance of over-collection, unintended copying, and cross-project secret exposure.

Content

Scanner excerpt · SKILL.md (reported line 110)May include surrounding context.

~/.config//credentials.json ~/.openclaw/workspace/memory/-creds.json ~/.openclaw/workspace/memory/credentials.json ~/.env (if exists, merges)

text

## Security Features

Credential Access

High

• Category: Privilege Escalation
• Confidence: 82% confidence

Finding

The example code imports helper functions that validate and retrieve credentials from the secure store, normalizing skill-level credential access. This is acceptable for a credential tool, but it should be treated as sensitive because it encourages downstream skills to depend on direct secret retrieval.

Content

Scanner excerpt · SKILL.md (reported line 257)May include surrounding context.

md

# Add credential-manager scripts to path
sys.path.insert(0, str(Path.home() / '.openclaw/skills/credential-manager/scripts'))

# Enforce secure .env (exits if not compliant)
from enforce import require_secure_env, get_credential

require_secure_env()

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The bash example sources ~/.openclaw/.env directly into the shell. Sourcing executes shell syntax, so if the file contains malicious command substitutions or crafted content, using it as code can lead to command execution and secret exposure.

Content

Scanner excerpt · SKILL.md (reported line 277)May include surrounding context.

fi

Now safe to load

source ~/.openclaw/.env

text

**This creates a fail-fast system:** If credentials aren't properly secured, skills refuse to run. Users are forced to fix it.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 75% confidence

Finding

The Python example reads the entire .env file and loads all variables into process environment state. Bulk-loading all secrets increases accidental exposure risk through subprocess inheritance, debugging output, or unrelated code paths.

Content

Scanner excerpt · SKILL.md (reported line 291)May include surrounding context.

md

import os
from pathlib import Path

# Load .env
env_file = Path.home() / '.openclaw' / '.env'
with open(env_file) as f:
    for line in f:

Credential Access

High

• Category: Privilege Escalation
• Confidence: 74% confidence

Finding

Opening and iterating the .env file is expected, but the example's simplistic parsing can mishandle quoting, malformed lines, or dangerous values, leading to incorrect credential loading or accidental leakage. In a security skill, weak parsing guidance is a meaningful risk.

Content

Scanner excerpt · SKILL.md (reported line 292)May include surrounding context.

md

from pathlib import Path

# Load .env
env_file = Path.home() / '.openclaw' / '.env'
with open(env_file) as f:
    for line in f:
        if '=' in line and not line.strip().startswith('#'):

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This example again advises sourcing the .env file in bash, which treats file contents as executable shell input rather than inert configuration data. If an attacker can modify the file or inject crafted values, this can trigger arbitrary command execution when users follow the documentation.

Content

Scanner excerpt · SKILL.md (reported line 305)May include surrounding context.

Bash

bash

# Load .env
set -a
source ~/.openclaw/.env
set +a

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security.md (reported line 68)May include surrounding context.

Use Separate Credentials

bash

# Development
~/.openclaw/.env.development

# Production
~/.openclaw/.env.production

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · references/security.md (reported line 71)May include surrounding context.

~/.openclaw/.env.development

Production

~/.openclaw/.env.production

Never mix environments

text

Credential Access

High

• Category: Privilege Escalation
• Confidence: 92% confidence

Finding

Decrypting a secret file directly into /tmp/.env is risky because /tmp is a shared, world-searchable location on many Unix systems and may be monitored, backed up, or left behind after crashes. Even if the file's default mode is restrictive, placing plaintext credentials in a transient shared area materially increases the chance of accidental exposure.

Content

Scanner excerpt · references/security.md (reported line 120)May include surrounding context.

gpg -c ~/.openclaw/.env

Decrypt when needed

gpg -d ~/.openclaw/.env.gpg > /tmp/.env

text

### Use Secret Managers

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

The incident-response example performs in-place text replacement of old and new secrets via sed, which can leak both credentials through shell history, process listings, logs, or recovery artifacts. Documentation that normalizes direct command-line handling of plaintext secrets increases operational exposure during emergency rotation.

Content

Scanner excerpt · references/security.md (reported line 193)May include surrounding context.

bash

# 1. Revoke old key in service dashboard
# 2. Generate new key
# 3. Update .env
sed -i 's/old_key/new_key/' ~/.openclaw/.env
# 4. Test
./test_credentials.sh

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

This line is part of the same sed-based credential replacement example and inherits the same exposure risk: plaintext credentials may appear in shell history, process arguments, audit logs, or terminal recordings. In a credential-management skill, such examples are more sensitive because users may copy them verbatim during real secret rotations.

Content

Scanner excerpt · references/security.md (reported line 194)May include surrounding context.

md

# 1. Revoke old key in service dashboard
# 2. Generate new key
# 3. Update .env
sed -i 's/old_key/new_key/' ~/.openclaw/.env
# 4. Test
./test_credentials.sh
# 5. Monitor logs

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CHANGELOG.md (reported line 81)May include surrounding context.

Social & Agent Networks

X (Twitter)

File patterns: x/credentials.json, twitter/credentials.json

Keys:

env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CONSOLIDATION-RULE.md (reported line 31)May include surrounding context.

Social & Agent Networks

X (Twitter)

File patterns: x/credentials.json, twitter/credentials.json

Keys:

env

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · CORE-PRINCIPLE.md (reported line 13)May include surrounding context.

Social & Agent Networks

X (Twitter)

File patterns: x/credentials.json, twitter/credentials.json

Keys:

env

Static analysis

No suspicious patterns detected.