Gateway Token Doctor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 2:26 AM UTC
• Version: 1.0.0

Overview

This skill is meant to fix gateway token mismatches, but its instructions can expose full access tokens and persist them insecurely.

Review before installing. Do not run the snippets as written in shared terminals, CI, transcripts, screenshots, or support sessions. Redact token output, compare tokens without printing them, avoid storing gateway tokens in startup scripts, and rotate any token that was previously printed or saved in an exposed file.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:19
• Finding: Raw Gateway Tokens Are Disclosed in Console Output## Vulnerability Details **File Location**: `SKILL.md`, lines 19–29 **Vulnerability Type**: Sensitive credential exposure through console output **Risk Level**: High **Vulnerable Code**: ```powershell # Check all token surfaces $cfg = Get-Content "$HOME/.openclaw/openclaw.json" -Raw | ConvertFrom-Json $auth = $cfg.gateway.auth.token $remote = $cfg.gateway.remote.token $service = $env:OPENCLAW_GATEWAY_TOKEN "auth.token = $auth" "remote.token = $remote" "service.token = $service" if ($auth -and $remote -and $auth -ne $remote) { ``` ### Technical Analysis The audit workflow reads gateway credentials from the OpenClaw configuration and the `OPENCLAW_GATEWAY_TOKEN` environment variable, then interpolates their complete values into console output. This exposes reusable authentication material to terminal history, CI logs, Agent transcripts, monitoring systems, screenshots, and any other mechanism that captures standard output. This behavior directly contradicts the skill's own privacy guidance at lines 68–69, which states that actual token values must never be logged and should be redacted. Token equality can be determined entirely in memory; displaying the credentials is unnecessary for the diagnostic task. ### Attack Path 1. An operator or automated Agent invokes the documented token-audit workflow. 2. PowerShell loads gateway tokens from the configuration file and environment. 3. The three string expressions print the complete token values. 4. The output is retained in a terminal transcript, CI log, support record, Agent conversation, or screenshot. 5. A party with access to that retained output copies a disclosed token. 6. The party presents the token to gateway or CLI endpoints that accept it. ### Impact Assessment Disclosure permits an unauthorized party to obtain the same gateway access granted by the exposed token. The precise privileges depend on the gateway's authorization model and token sco ...[truncated 406 chars]
• Remediation: ## Remediation Suggestions - Remove every statement that prints a complete token. - Report only whether each token is present and whether the values match. - If a diagnostic identifier is necessary, display a non-reversible cryptographic fingerprint rather than a token substring. If compatibility requires redaction, reveal no more than the documented four-character prefix and clearly mark the remaining value as redacted. - Ensure exceptions and debug logs cannot serialize the configuration object or environment variable. - Treat any token previously exposed through this workflow as compromised: revoke it, generate a replacement, update authorized credential stores, and remove retained logs where feasible. - Add a regression check that fails when output contains any complete fixture token.

T09 · Insecure Skill Coding Practices

Warning

• Location: references/privacy-checklist.md:10
• Finding: Privacy Scan Prints Complete Secret-Bearing Lines## Vulnerability Details **File Location**: `references/privacy-checklist.md`, lines 10–13 **Vulnerability Type**: Sensitive data exposure through unsafe secret scanning **Risk Level**: Medium **Vulnerable Code**: ```powershell **Scan Command**: ```powershell Get-ChildItem . -Recurse -File | Select-String -Pattern 'apiKey|token|secret|password' -CaseSensitive:$false ``` ``` ### Technical Analysis `Select-String` emits each matching line by default. If a source file contains an API key, token, secret, or password on the matched line, the scan intended to detect the credential will reproduce it in standard output. The command recursively scans from the current directory without first confirming that it is the project root. If executed from a broader directory, it may inspect unrelated configuration, backup, generated, or user files. Matching only broad keywords also does not reliably distinguish credential names from actual secret values, while still exposing the entire line. No external transmission is implemented by the command itself. Exploitation depends on another party gaining access to captured output, but the command unnecessarily expands the number of places in which sensitive data can appear. ### Attack Path 1. A user runs the checklist command in a directory containing one or more files with inline credentials. 2. Recursive enumeration locates those files. 3. `Select-String` matches a credential-related keyword. 4. PowerShell prints the complete matching line, potentially including the credential value. 5. The output is captured in an Agent transcript, CI log, terminal recording, support bundle, or screenshot. 6. A party with access to that output extracts and reuses the credential against its associated service. ### Impact Assessment An exposed credential can grant the permissions assigned to that credential, potentially including access to APIs, local services, gateway functions, or protected dat ...[truncated 332 chars]
• Remediation: ## Remediation Suggestions - Resolve and validate the intended project root before recursive scanning. - Emit only file paths and line numbers, not complete matching lines. - Redact suspected values before any result is displayed or stored. - Exclude irrelevant or sensitive directories such as version-control metadata, dependency caches, build output, backups, and credential-store directories. - Prefer a dedicated secret scanner that reports rule identifiers and locations while masking detected values. - Prevent scan output from being retained in public CI artifacts or unrestricted Agent transcripts. - Document that users must not paste raw findings containing secrets into issue trackers or support channels.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:37
• Finding: Gateway Token Is Persisted in a Plaintext Startup Script## Vulnerability Details **File Location**: `SKILL.md`, lines 37–46 **Vulnerability Type**: Plaintext credential storage and unsafe configuration rewriting **Risk Level**: High **Vulnerable Code**: ```powershell # Generate or use existing token $token = $auth # Update config $cfg.gateway.auth.token = $token $cfg.gateway.remote.token = $token $cfg | ConvertTo-Json -Depth 10 | Out-File "$HOME/.openclaw/openclaw.json" -Encoding UTF8 # Update service startup script $servicePath = "$HOME/.openclaw/gateway.cmd" $content = Get-Content $servicePath -Raw $content = $content -replace 'OPENCLAW_GATEWAY_TOKEN=.*', "OPENCLAW_GATEWAY_TOKEN=$token" $content | Out-File $servicePath -Encoding UTF8 ``` ### Technical Analysis The alignment workflow embeds a reusable gateway token directly in `gateway.cmd`. Any principal able to read that startup script can recover the credential without interacting with a protected secret provider. The implementation does not verify or harden the file's access-control list before writing the token. This behavior contradicts the skill's privacy statement that tokens should be stored only in configuration files. The command also rewrites the complete startup script in place without an atomic replacement, backup, target validation, or confirmation that exactly one intended assignment was replaced. The regular expression applies to every matching line and is not anchored to a tightly validated command structure. The operation is consistent with the skill's stated authentication-repair purpose and is not evidence of malicious persistence. The vulnerability is the insecure storage and update method. ### Attack Path 1. An authorized operator runs the alignment workflow. 2. The workflow selects `$auth` as the shared gateway token. 3. PowerShell inserts the complete token into `gateway.cmd`. 4. The resulting script remains on disk after the skill run. 5. A local user, process, backup reader, m ...[truncated 893 chars]
• Remediation: ## Remediation Suggestions - Store the token in an operating-system credential manager or a protected service-secret facility rather than embedding it in a command script. - Configure the service to retrieve the credential at runtime through the protected mechanism. - If file-based storage is unavoidable, keep the token in a dedicated secret file, apply least-privilege ACLs before writing it, and prevent inheritance that grants unintended read access. - Validate that the destination is the expected regular file and not a symbolic link or reparse point. - Use an atomic update: create a permission-restricted temporary file in the same directory, validate its content, and atomically replace the target. - Create a protected backup and provide rollback behavior, while ensuring backups containing credentials receive equally restrictive access controls. - Anchor and validate any replacement expression, require exactly one intended match, and abort safely if the expected assignment is absent or duplicated. - Rotate tokens already persisted in scripts and securely remove obsolete script copies and backups.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (3)

Intent-Code Divergence

High

• Confidence: 99% confidence
• Finding: The audit workflow prints the full values of auth, remote, and service tokens directly to output, which can expose active credentials in terminal scrollback, logs, screenshots, CI captures, or shared support sessions. This directly contradicts the skill's own privacy guidance and creates a realistic secret disclosure path for a credential used to authenticate gateway access.

Missing User Warnings

High

• Confidence: 99% confidence
• Finding: The example workflow exposes full gateway token values during diagnosis even though the safety section says tokens should never be logged and should be redacted. Because this skill is specifically intended for troubleshooting authentication failures, users are likely to run these commands in real environments, making accidental credential leakage highly plausible.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The fix writes the gateway token into a service startup script, creating another plaintext secret storage location that may have broader file-read exposure, be backed up, or be accidentally committed or shared. In context, this is especially risky because the privacy section says tokens should be stored only in config files, so the skill encourages insecure secret sprawl while claiming safer handling.

Static analysis

No suspicious patterns detected.