T09 · Insecure Skill Coding Practices
Warning
- Location
- src/index.ts:10
- Finding
- Configured AIN Configuration Path Is Ignored## Vulnerability Details **File Location**: `src/index.ts:10-12` **Vulnerability Type**: Configuration security-boundary bypass **Risk Level**: Medium ### Vulnerable Code ```ts async register(api: OpenClawPluginApi) { const pluginConfig = api.pluginConfig as AinPluginConfig; const config = loadConfig(); registerAinProviders(api, config); ``` The plugin declares and documents a `configPath` setting, but it invokes `loadConfig()` without using `pluginConfig.configPath`. Consequently, an operator-supplied path intended to select a restricted or trusted AIN configuration has no effect. The loaded configuration is subsequently used to register all configured providers. The routing hook and `ain_run` tool may then select those providers and transmit prompts or conversation messages to their configured endpoints. ### Technical Analysis A configuration path can act as a security boundary when separate files contain different providers, credentials, endpoint allowlists, or data-handling policies. Ignoring that option causes the plugin to use the dependency's default configuration—documented as `~/.ain/config.yaml`—instead of the operator-selected file. This is a fail-open configuration error. The plugin reports successful registration without warning that the requested configuration was not used. The same behavior exists in the distributed runtime at `dist/index.js:10-12`. ### Attack Path 1. An operator configures `configPath` to point to a restricted AIN configuration containing only approved providers. 2. The plugin ignores this value and calls `loadConfig()` with no path. 3. A different default AIN configuration is loaded from the environment. 4. Providers in that default configuration are registered with OpenClaw. 5. The automatic routing hook or an invocation of `ain_run` selects one of those providers. 6. Prompt, system-message, or conversation data is transmitted to an endpoint the operator did not intend ...[truncated 768 chars]
- Remediation
- ## Remediation Suggestions 1. Pass the configured path to the AIN configuration loader using the API supported by `@felipematos/ain-cli`. 2. Validate that `configPath`, when supplied, is a non-empty string and resolves to the intended file. 3. Fail closed if an explicitly requested configuration cannot be read or parsed; do not silently fall back to the default configuration. 4. Log the resolved configuration path without logging provider credentials or other secrets. 5. Consider restricting configuration paths to an operator-approved directory if untrusted parties can modify plugin configuration. 6. Add tests verifying that: - A custom `configPath` is passed to the loader. - An invalid explicit path prevents registration. - Providers from the default configuration are not registered when a custom configuration is selected. 7. Rebuild `dist/index.js` after applying the source fix.