T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:59
- Finding
- Plaintext API Key Exposure Through Shell Commands and Persistent Configuration## Vulnerability Details **File Location**: `SKILL.md:59-74` and `references/troubleshooting.md:13-17` **Vulnerability Type**: Plaintext sensitive credential handling **Risk Level**: Medium ### Vulnerable Code `SKILL.md:59-74`: ```markdown ### 2. Make the key available to OpenClaw Set `DANUBE_API_KEY` in the environment, or in `openclaw.json`: ```json5 { skills: { entries: { danube: { apiKey: "YOUR_DANUBE_API_KEY" } } } } ``` ### 3a. Connect natively over MCP (recommended) OpenClaw has a built-in MCP client. Register Danube's server once and its tools become ordinary OpenClaw tools (`search_tools`, `execute_tool`, …): ```bash openclaw mcp set danube '{"url":"https://mcp.danubeai.com/mcp","transport":"streamable-http","headers":{"danube-api-key":"YOUR_DANUBE_API_KEY"}}' openclaw mcp doctor danube --probe ``` Use the real key value in `headers` (not `${DANUBE_API_KEY}`). The server also speaks MCP OAuth: use `"auth":"oauth"` instead of `headers`, then `openclaw mcp login danube`. ``` `references/troubleshooting.md:13-17`: ```markdown If the key lives only in `openclaw.json`, make sure it's under the skill's entry, which is what `primaryEnv` binds to: ```json5 { skills: { entries: { danube: { enabled: true, apiKey: "YOUR_DANUBE_API_KEY" } } } } ``` ``` ### Technical Analysis The instructions explicitly direct users to substitute a live Danube API key into an `openclaw mcp set` command and permit storing the key directly in `openclaw.json`. Although authentication to Danube is necessary for the Skill's declared functionality, placing the secret directly in a command or plaintext configuration expands its exposure beyond the minimum necessary scope. A key embedded in a command can be retained in shell history and may be visible temporarily through process inspection or terminal/session logging. A key persisted in configuration can be exposed through permissive file permissions, backups, synchr ...[truncated 2350 chars]
- Remediation
- ## Remediation Suggestions 1. Make the documented MCP OAuth flow the default setup method: ```bash openclaw mcp set danube '{"url":"https://mcp.danubeai.com/mcp","transport":"streamable-http","auth":"oauth"}' openclaw mcp login danube ``` This avoids placing a reusable API key directly in command history. 2. If an API key must be used, integrate with a supported secret manager or protected credential facility rather than embedding the value in a command or general configuration file. 3. Avoid command-line arguments containing live credentials. If OpenClaw cannot securely resolve environment variables in MCP headers, document that limitation and recommend OAuth rather than instructing users to paste the key into the command. 4. If plaintext configuration remains supported, require restrictive file permissions and document them explicitly. For example, ensure that only the owning user can read the configuration. 5. Recommend narrowly scoped Danube keys restricted to only the required services and tools. Enable destructive-operation confirmation and conservative spending limits by default. 6. Ensure configuration files containing credentials are excluded from source control, support bundles, shared archives, and cloud synchronization unless encrypted. 7. Warn users to disable shell history temporarily or remove the relevant history entry if they previously pasted a key into a command. 8. Rotate any key that may already have appeared in shell history, logs, shared configuration, or backups, and review its Danube audit trail for unexpected activity.