T09 · Insecure Skill Coding Practices
Error
- Location
- analyzer.js:965
- Finding
- Full OpenClaw Configuration and Credentials Exposed Through JSON Output<![CDATA[ ## Vulnerability Details **File Location**: `analyzer.js:965-975`, `run.js:79-83` **Vulnerability Type**: Sensitive configuration disclosure **Risk Level**: High ### Vulnerable Code ```js return { scannedAt: new Date().toISOString(), configPath, sessionsPath, primaryModel: configResult.primaryModel, findings: allFindings, summary: { // ... }, sessions: sessionResult.sessions || [], webChatSessions, config: configResult.config, }; ``` ```js if (flags.json) { console.log(JSON.stringify(analysis, null, 2)); process.exit(0); } ``` ### Technical Analysis The analyzer includes the complete parsed `openclaw.json` object in its result. The JSON output mode then serializes the entire result to standard output without redaction. The configuration is known to contain sensitive properties because the analyzer itself examines fields such as Telegram `botToken`, Discord `token`, Signal phone numbers, hook tokens, channel policies, and other operational settings. Returning the source configuration is unnecessary for cost analysis and exceeds the minimum data required by the report. No direct external exfiltration is implemented in this path. Nevertheless, credentials can be exposed through terminal history, command logs, redirected output, CI logs, agent transcripts, or downstream programs consuming the JSON. ### Attack Path 1. The victim stores API keys, bot tokens, or other credentials in `openclaw.json`. 2. The victim or an automated agent invokes `node run.js --json`. 3. `runAnalysis()` returns the complete source configuration as `analysis.config`. 4. `JSON.stringify()` writes the configuration and credentials to standard output. 5. A log collector, redirected file, AI-agent transcript, or downstream process captures the secrets. 6. Anyone with access to that output can reuse exposed credentials according to their original privileges. ### Impact Assessment An attacker obtaining the output may gain access to messagi ...[truncated 283 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove `config: configResult.config` from the returned analysis object. - Construct a minimal result containing only fields needed for cost reporting. - Implement recursive redaction as a defense-in-depth measure for keys matching patterns such as `token`, `secret`, `password`, `apiKey`, `credential`, `authorization`, and private-key material. - Ensure all output modes operate on a sanitized view rather than the raw analysis object. - Add automated tests using representative secret-bearing configurations and assert that no secret appears in terminal, Markdown, JSON, HTML, or snapshot output. - Warn users that older reports and logs may already contain credentials and recommend rotating any exposed tokens. ]]>