T09 · Insecure Skill Coding Practices
- Location
SKILL.md:303- Finding
API Key Exposure Through Unsafe Shell Setup and Troubleshooting Instructions
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 303–318 and line 510
Vulnerability Type: Credential exposure through shell history and plaintext terminal output
Risk Level: MediumVulnerable Code
markdown **Setup:** 1. Get a free API key at **https://mobula.io** (100 requests/minute free tier) 2. Set environment variable: ```bash export MOBULA_API_KEY="your_key_here" ``` 3. Restart OpenClaw agent **Header format:**Authorization: ${MOBULA_API_KEY}
text **If authentication fails (401/403):** - Verify key is set: `echo $MOBULA_API_KEY` - Regenerate key at https://mobula.io if expired - Check rate limits (100 req/min free, upgrade for more)The same unsafe setup pattern is repeated at line 510:
markdown - **No key set:** "I need a Mobula API key to fetch crypto data. Get one free at https://mobula.io then add it to your environment with `export MOBULA_API_KEY='your_key'`"Technical Analysis
The Skill instructs users to place the Mobula API key directly in an interactive shell command. Depending on shell configuration, the complete command and credential may be retained in shell history. It also recommends
echo $MOBULA_API_KEYwhen troubleshooting, which prints the entire secret in plaintext.Printing the secret can expose it through terminal scrollback, command transcripts, Agent conversation context, CI logs, support records, screen sharing, or screen recordings. Merely confirming whether the variable exists does not require revealing its value.
Sending the key to Mobula in an authentication header is necessary for the declared functionality and is not independently a vulnerability. The problem is the local setup and diagnostic procedure unnecessarily exposing the credential.
Attack Path
- A user follows the documented setup command and substitutes a real Mobula API key.
- The shell records the command, including the key, in h ...[truncated 989 chars]
- Remediation
View remediation
Remediation Suggestions
-
Remove the instruction to print the secret. Test only whether the variable is populated:
bash if [ -n "${MOBULA_API_KEY:-}" ]; then echo "MOBULA_API_KEY is set" else echo "MOBULA_API_KEY is missing" fi -
Avoid placing the key directly on an interactive command line. Use hidden input where appropriate:
bash read -rsp "Mobula API key: " MOBULA_API_KEY echo export MOBULA_API_KEY -
Prefer a supported secret manager or a protected environment file excluded from version control. Restrict any credential file to the owning user, such as with mode
0600. -
Ensure the Agent, shell, CI system, and HTTP client redact
MOBULA_API_KEYandAuthorizationheader values from logs and transcripts. -
Replace the line 510 setup guidance with a reference to secure credential configuration rather than embedding an
exportcommand containing the key. -
Document immediate rotation and revocation procedures for credentials that have been printed, committed, recorded, or otherwise exposed.
-