ClawHub
Back to skill

Security audit

Env Alias Audit

Security checks for vulnerabilities and agentic risk

Overview

The skill is purpose-aligned, but it can print full or partial environment secret values to terminal or CI logs.

Review before installing or running in CI. Use only on local files you are comfortable exposing in terminal output, avoid production secrets unless the script is changed to print only variable names and set/unset status, and rotate any credentials that may already have appeared in retained logs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
scripts/audit-env-aliases.sh:82
Finding

Sensitive Environment Values Disclosed in Audit Output

Content
View full analysis

Vulnerability Details

File Location: scripts/audit-env-aliases.sh:82-87, 113-116, 136, 145-147
Vulnerability Type: Sensitive information exposure through terminal and log output
Risk Level: Medium

Vulnerable Code

python
def short(value: str):
    if value == '':
        return '(empty)'
    if len(value) <= 16:
        return value
    return value[:8] + '…' + value[-4:]
python
if len(distinct) > 1:
    preview = ', '.join([f'{k}={short(v)}' for k, v in present])
    failures.append(f'{canonical}: conflicting values across aliases ({preview})')
    print(f'FAIL {canonical} -> conflict across {len(present)} keys')
    continue
python
print(f'OK   {canonical} -> ' + (short(present[0][1]) if present else 'unset'))
python
if failures:
    print('FAILURES:', file=sys.stderr)
    for item in failures:
        print(f'- {item}', file=sys.stderr)
    sys.exit(1)

Technical Analysis

The script reads potentially sensitive values from .env files, including Stripe API keys, webhook secrets, and database connection URLs. The short() function is intended to abbreviate those values, but it prints values of 16 characters or fewer in full. For longer values, it exposes the first eight and final four characters.

This function is used in normal successful status output and when constructing conflict diagnostics. Consequently, secret material is written to standard output or standard error, where it can be captured by CI/CD systems, deployment logs, terminal recording, build artifacts, or centralized logging services.

Truncation is not an adequate security control. Prefixes and suffixes may identify credentials, reveal structural information, facilitate correlation across systems, or reduce the search space for guessing attacks. Database URLs may also expose usernames, hostnames, database names, and portions of embedded passwords.

Attack Path

  1. A user or automated CI/CD process runs the documented ...[truncated 1752 chars]
Remediation
View remediation

Remediation Suggestions

  1. Never include environment values, whether complete or truncated, in routine status, warning, or error output.
  2. Replace value-bearing output with state-only messages. For example:
python
if len(distinct) > 1:
    conflicting_keys = ', '.join(k for k, _ in present)
    failures.append(
        f'{canonical}: conflicting values across keys ({conflicting_keys})'
    )
  1. Change successful output to report only whether a group is set:
python
print(f'OK   {canonical} -> ' + ('set' if present else 'unset'))
  1. Remove the short() function after all value-rendering call sites have been eliminated.
  2. Ensure conflict diagnostics list only variable names, never their values.
  3. Add automated tests that populate the input file with unique sentinel secrets, execute every status path, and assert that neither complete values nor substrings appear in standard output or standard error.
  4. Review CI/CD log retention and access controls, and purge historical logs containing output from affected executions where feasible.
  5. Rotate credentials if prior audit output may have been retained or exposed, prioritizing any credentials short enough to have been printed completely.

SkillSpector

Vulnerability Patterns
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • MCP Least PrivilegeUnderdeclared Capability, Wildcard Permission, Missing Permission Declaration
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
Findings (4)

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 3)May include surrounding context.

md
---
name: env-alias-audit
description: Audit .env alias groups for missing required config, conflicting values, and canonical-key drift before deploy.
version: 1.0.0
metadata: {"openclaw":{"requires":{"bins":["bash","python3"]}}}
---

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 31)May include surrounding context.

md
---
name: env-alias-audit
description: Audit .env alias groups for missing required config, conflicting values, and canonical-key drift before deploy.
version: 1.0.0
metadata: {"openclaw":{"requires":{"bins":["bash","python3"]}}}
---

Credential Access

High
Category
Privilege Escalation
Confidence
60% confidence
Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SKILL.md (reported line 39)May include surrounding context.

Use custom alias spec:

bash
ENV_FILE=.env.production \
ALIAS_SPEC_FILE=skills/env-alias-audit/fixtures/alias-spec.sample \
AUDIT_MODE=report \
bash skills/env-alias-audit/scripts/audit-env-aliases.sh

Undeclared Tool Scope

Medium
Category
MCP Least Privilege
Confidence
70% confidence
Finding

Without declared permissions the skill's intent is opaque and cannot be validated.

Content

No source excerpt is available for this finding.