T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:31
- Finding
- API key file may be readable by other local users<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 31–32 **Vulnerability Type**: Insecure credential file permissions **Risk Level**: Medium ### Vulnerable Code ```bash mkdir -p ~/.openclaw/secrets echo 'AGENTIC_LETTERS_API_KEY=al_your_api_key' > ~/.openclaw/secrets/agentic_letters.env ``` ### Technical Analysis The documented setup procedure creates the secrets directory and API key file without explicitly assigning restrictive filesystem permissions. Their resulting modes therefore depend on the user's current `umask`. With a common `022` umask, the directory may be created as `0755` and the credential file as `0644`. The file contains a bearer token associated with the user's paid AgenticLetters credits. Possession of this token is sufficient to authenticate requests to the service. This access is not required for the Skill's declared functionality. Only the account running the Skill needs to read the credential. ### Attack Path 1. A victim follows the documented setup commands under a permissive `umask`. 2. The secrets directory and API key file are created with group-readable or world-readable permissions. 3. Another local account traverses the victim's home directory, where permitted, and reads `~/.openclaw/secrets/agentic_letters.env`. 4. The attacker extracts the `AGENTIC_LETTERS_API_KEY` bearer token. 5. The attacker submits authenticated requests to the AgenticLetters API, potentially sending letters, consuming paid credits, or querying API-accessible letter information. Exploitation requires local filesystem access and sufficient permission to traverse the victim's home directory. ### Impact Assessment An attacker who obtains the token gains the API capabilities assigned to that token. Based on the audited client, these capabilities include submitting physical letters, listing letters, retrieving letter status, and checking remaining credits. The impact is limited to the AgenticLetters account and API authorization s ...[truncated 231 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Create the secrets directory and credential file with explicit owner-only permissions: ```bash install -d -m 700 ~/.openclaw/secrets umask 077 printf '%s\n' 'AGENTIC_LETTERS_API_KEY=al_your_api_key' \ > ~/.openclaw/secrets/agentic_letters.env chmod 600 ~/.openclaw/secrets/agentic_letters.env ``` Additional hardening should include: 1. Prefer an operating-system credential store or secret manager over a plaintext environment file. 2. Validate the permissions and ownership of the credential file before reading it. 3. Refuse to use a credential file owned by another account or writable by group/other users. 4. Document token revocation or rotation procedures for suspected exposure. 5. Advise existing users to apply `chmod 700` to the directory and `chmod 600` to the file. ]]>