T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:32- Finding
Credential file setup does not enforce restrictive permissions
- Content
View full analysis
~/.openclaw/credentials/laravel-cloud/config.json ``` ``` The credential is subsequently consumed by `scripts/laravel-cloud.sh:7,25-26`: ```bash CREDS="${HOME}/.openclaw/credentials/laravel-cloud/config.json" [[ -z "${LARAVEL_CLOUD_API_TOKEN:-}" ]] && [[ -f "$CREDS" ]] && \ LARAVEL_CLOUD_API_TOKEN=$(jq -r '.token // empty' "$CREDS" 2>/dev/null || true) ``` ### Technical Analysis The documented setup writes a long-lived Laravel Cloud bearer token to disk without explicitly controlling the permissions of either the credential directory or the resulting file. The effective modes depend on the user's current `umask`. Under common defaults, the directory may be created as mode `755` and the file as mode `644`, making the token readable by other local accounts. Reading this specific credential path is necessary for the declared authentication fallback. The excessive behavior is not the path access itself, but the failure to enforce least-privilege access when instructing users to create the secret. Because this token is used as a Bearer credential, possession is generally sufficient for authentication. The script exposes broad Laravel Cloud management functionality, including remote commands, environment-variable management, deployments, storage-key management, and destructive resource operations. The exact authority available to an attacker depends on the token's server-side permissions. ### Attack Path 1. A user follows the documented file-based setup instructions. 2. The user's `umask` permits group or world read access to newly created files. 3. `config.json` is created with permissions that allow another local account or process to rea ...[truncated 1108 chars]- Remediation
View remediation
"$HOME/.openclaw/credentials/laravel-cloud/config.json" chmod 600 "$HOME/.openclaw/credentials/laravel-cloud/config.json" ``` Additional hardening should include: 1. Prefer `LARAVEL_CLOUD_API_TOKEN` or a secret manager such as the already supported 1Password reference mechanism. 2. Validate file ownership and permissions before loading the credential, and reject files writable or readable by unauthorized principals. 3. Document that users should issue narrowly scoped tokens where Laravel Cloud supports such restrictions. 4. Recommend regular token rotation and immediate revocation after suspected disclosure. 5. Avoid embedding real tokens directly into shell commands where they may enter shell history; provide an interactive or secret-manager-based setup process. ]]>