T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/cleanup_verlaengerungen.js:15- Finding
Shared OpenClaw credential file is read and indiscriminately imported into the process environment
- Content
View full analysis
{ const match = line.match(/^([^#=]+)=(.*)$/); if (match) { const key = match[1].trim(); let val = match[2].trim(); val = val.replace(/^["']|["']$/g, ''); process.env[key] = val; } }); ``` Only three values are subsequently needed: ```javascript const clientId = process.env.M365_CLIENT_ID; const clientSecret = process.env.M365_CLIENT_SECRET; const tenantId = process.env.M365_TENANT_ID; ``` ### Technical Analysis Each Node.js script reads the complete shared `~/.openclaw/.env` file and copies every parsed entry into the global process environment. The Skill only needs `M365_CLIENT_ID`, `M365_CLIENT_SECRET`, and `M365_TENANT_ID`, but unrelated credentials stored in the same OpenClaw environment file are also exposed to the entire Node.js process and every loaded dependency. The reviewed code does not launch child processes or transmit unrelated environment variables, and no active exfiltration of those unrelated secrets was identified. Nevertheless, the implementation violates least exposure: a compromised dependency, diagnostic module, future child process, or later code change would be able to access credentials unrelated to Microsoft Planner. The fixed file path itself is documented and appropriate for the declared integration. The weakness is reading and importing every value rather than selecting only the required keys. ...[truncated 960 chars]- Remediation
View remediation