T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
scripts/assess.js:116- Finding
Excessive Inspection of Credentials, Agent Memory, and Global Configuration
- Content
View full analysis
0) { evidence.proof.walletFiles = walletFiles.map(f => path.basename(f)); points += 10; } // Check for Bankr credentials const bankrCreds = this.safeReadJson(path.join(this.config.workspace, 'bankr-credentials.json')); if (bankrCreds?.api_key) { evidence.proof.bankrConfigured = true; points += 15; } // Check for x402 wallet const x402Wallet = this.safeReadJson(path.join(this.config.workspace, 'x402-wallet.json')); if (x402Wallet?.address) { evidence.proof.x402Wallet = x402Wallet.address; points += 10; } // Check for on-chain identity const memoryPath = path.join(this.config.workspace, 'MEMORY.md'); if (memoryPath && fs.existsSync(memoryPath)) { const memory = fs.readFileSync(memoryPath, 'utf8'); if (memory.includes('ERC-8004') && memory.includes('0x')) { evidence.proof.onChainIdentity = 'ERC-8004 registered'; points += 20; } const txMatches = memory.match(/transaction|transfer|swap|bridge/gi); if (txMatches && txMatches.length > 5) { evidence.proof.transactionHistory = `${txMatches.length} TX references`; points += 15; } } ``` ```javascript // Check gateway config for channels const gatewayConfig = this.safeReadJson(this.config.openclawConfig); const channels = gatewayConfig?.channels || {}; const activeChannels = Object.keys(channels).filter(k => channels[k]?.enabled !== false); evidence.proof.channels = activeChannels; points += Math.min(25, activeChannels.length * 8); // Check for email capability const protonCreds = this.safeReadJson(path.join(this.config.workspa ...[truncated 3591 chars]- Remediation
View remediation