T05 · Unauthorized Access and Privilege Escalation
Error
- Location
entrypoint_helpers.py:20- Finding
Unnecessary Import of All OpenClaw Secrets into the Doctor Process Environment
- Content
View full analysis
list[Path]: candidates: list[Path] = [] openclaw_root = os.environ.get("OPENCLAW_ROOT", "").strip() if openclaw_root: candidates.append(Path(openclaw_root) / "secrets.env") openclaw_workspace = os.environ.get("OPENCLAW_WORKSPACE", "").strip() if openclaw_workspace: candidates.append(Path(openclaw_workspace).parent / "secrets.env") if skill_root.parent.name == "skills" and skill_root.parent.parent.name == "workspace": candidates.append(skill_root.parent.parent.parent / "secrets.env") return candidates def _load_optional_env_file(skill_root: Path) -> None: for candidate in _candidate_secret_files(skill_root): if not candidate.is_file(): continue for raw_line in candidate.read_text(encoding="utf-8").splitlines(): line = raw_line.strip() if not line or line.startswith("#") or "=" not in line: continue key, value = line.split("=", 1) key = key.strip() if not key or key in os.environ: continue value = value.strip().strip("'\"") os.environ[key] = value return ``` ### Technical Analysis The doctor entry point calls `run_profile()`, which invokes `_load_optional_env_file()` before entering the diagnostic workflow. This function searches OpenClaw-related directories for `secrets.env`, reads the first matching file, and imports every key-value pair into the process environment. There is no allowlist limiting access to credentials that are demonstrably necessary for the environment check. The declared doctor functionality only needs to inspect the gateway, runtime dependencies, task-bundle av ...[truncated 1596 chars]- Remediation
View remediation