T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:86- Finding
Overbroad Discovery and Use of Credentials from General-Purpose Environment Files
- Content
View full analysis
/dev/null | cut -d= -f2-) SECRET_KEY=$(grep '^BINANCE_SECRET_KEY=' ~/.openclaw/secrets.env 2>/dev/null | cut -d= -f2-) # Fallback: search .env in known directories (KEY=VALUE then raw line format) for dir in ~/.openclaw ~; do [ -n "$API_KEY" ] && break env_file="$dir/.env" [ -f "$env_file" ] || continue # Read first two lines line1=$(sed -n '1p' "$env_file") line2=$(sed -n '2p' "$env_file") # Check if lines contain '=' indicating KEY=VALUE format if [[ "$line1" == *=* && "$line2" == *=* ]]; then API_KEY=$(grep '^BINANCE_API_KEY=' "$env_file" 2>/dev/null | cut -d= -f2-) SECRET_KEY=$(grep '^BINANCE_SECRET_KEY=' "$env_file" 2>/dev/null | cut -d= -f2-) else # Treat lines as raw values API_KEY="$line1" SECRET_KEY="$line2" fi done ``` ### Technical Analysis Accessing the explicitly named `BINANCE_API_KEY` and `BINANCE_SECRET_KEY` variables is necessary for authenticated Binance requests. However, the fallback logic reads the first two lines of general-purpose files such as `~/.env` and treats them as Binance credentials when both lines do not contain an equals sign. A user's home-level `.env` file is not necessarily dedicated to this Skill. Its first two lines can contain unrelated passwords, access tokens, private keys, or other sensitive values. Reading arbitrary lines therefore exceeds the least privilege required by the declared Binance fiat functionality. The Skill also states that the first credential-discovery methods may be used automatically. Consequently, unrelated secrets can be accessed without the user explicitly selecting or approving the particular file. ### Attack Path 1. A user has a general-purpose `~/.env` fil ...[truncated 1317 chars]- Remediation
View remediation