T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:180
- Finding
- Diagnostic workflow may expose gateway authentication tokens in agent output## Vulnerability Details **File Location**: `SKILL.md:180-197` **Vulnerability Type**: Plaintext credential disclosure **Risk Level**: Medium ### Vulnerable Source Excerpt The following is an English translation of the complete source segment: ```text Example: [Diagnostic Result] Issue: Chrome extension connection failed with a red exclamation mark Root cause: The gateway token is empty, and the token entered in the extension does not match [Executed] Updated gateway.auth.token = "tianyi2026" Restarted the gateway service [User Action Required] 1. Enter this token in the extension options: tianyi2026 2. Save the settings and reconnect [Prevention] Synchronize the extension configuration after changing the token ``` Related instructions at `references/error-patterns.md:13-17` direct the agent to retrieve and inspect the configured token: ```text 1. Read the configuration and expand the gateway property. 2. Confirm the value of gateway.auth.token. 3. Enter the same token in the extension options. 4. If the configuration is empty, add a token and restart the gateway. ``` ### Technical Analysis The diagnostic process treats `gateway.auth.token` as ordinary diagnostic data and demonstrates reproducing its plaintext value in the generated report. Authentication secrets should not be returned in conversational output, logs, screenshots, or diagnostic histories. Because the skill instructs an AI agent to read `~\.openclaw\openclaw.json`, the model may ingest other sensitive configuration values as well. The output template does not require redaction, masking, local-only comparison, or confirmation that the requester is authorized to view the token. The literal value shown in the example may only be illustrative, so it is not established as a live credential. Nevertheless, the demonstrated behavior encourages unsafe plaintext handling of real tokens. ### Attack Path 1. An attacker or unauthori ...[truncated 995 chars]
- Remediation
- ## Remediation Suggestions 1. Prohibit disclosure of complete token values in all diagnostic output. 2. Mask secrets consistently, for example by displaying only the final four characters. 3. Compare tokens locally and report only whether they match. 4. Do not load the complete configuration into model context when a narrowly scoped parser can retrieve only non-secret metadata. 5. Require protected user input for token changes rather than asking users to paste credentials into chat. 6. Replace examples containing plaintext token values with placeholders such as `[REDACTED]`. 7. Ensure diagnostic history and logs apply secret-detection and redaction controls. 8. If a token may already have been disclosed, rotate it and invalidate the previous value. 9. Generate replacement tokens with a cryptographically secure random generator rather than using predictable examples.