T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/sync-runtime-to-artifact.sh:18
- Finding
- Unattended publication can expose personal, infrastructure, and sensitive workspace data<![CDATA[ ## Vulnerability Details **File Location**: `scripts/sync-runtime-to-artifact.sh:18-44`, with publication at `scripts/publish.sh:94-112` and sensitive-data collection encouraged by `agent/BOOTSTRAP.md:23-35` and `agent/TOOLS.md:5-25` **Vulnerability Type**: Excessively broad synchronization followed by unattended external publication **Risk Level**: High ### Complete Code Snippet ```bash # One-time safety cleanup: ensure runtime-only files never live in artifact rm -rf "${ARTIFACT_AGENT_DIR}/memory" >/dev/null 2>&1 || true rm -f "${ARTIFACT_AGENT_DIR}/.publish-state.json" >/dev/null 2>&1 || true rm -f "${ARTIFACT_AGENT_DIR}/.publish-now" >/dev/null 2>&1 || true rsync -a --delete \ --exclude '.openclaw/' \ --exclude '.git/' \ --exclude 'memory/' \ --exclude '.publish-state.json' \ --exclude '.publish-now' \ --exclude '**/.venv/' \ --exclude '**/__pycache__/' \ --exclude '**/*.pyc' \ --exclude '**/*.pyo' \ --exclude '**/.DS_Store' \ --exclude 'logs/' \ --exclude 'tmp/' \ "${RUNTIME_DIR}/" \ "${ARTIFACT_AGENT_DIR}/" # Record which runtime commit this artifact was synced from if command -v git >/dev/null 2>&1 && [[ -d "${RUNTIME_DIR}/.git" ]]; then (cd "${RUNTIME_DIR}" && git rev-parse HEAD) > "${ARTIFACT_AGENT_DIR}/.runtime-head" || true fi ``` The synchronized artifact is subsequently published: ```bash cd "${SKILL_DIR}" echo "Publishing ${SLUG}@${version} ..." # Best-effort: publishing may fail if not logged in; do not crash the whole system. # clawhub publish can occasionally timeout; retry a few times. try=1 max=3 ok="false" while [[ ${try} -le ${max} ]]; do echo "Publish attempt ${try}/${max}..." if "${CLAWHUB_BIN}" publish . --slug "${SLUG}" --name "${NAME}" --version "${version}" --changelog "${changelog}"; then ok="true"; break fi sleep $((try * 5)) try=$((try + 1)) done if [[ "${ok}" == "true" ]]; then mkdir -p "$(dirname "${STATE_FILE}")" node -e 'const fs=require("fs"); const p=process.ar ...[truncated 2940 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace denylist-based workspace synchronization with an explicit allowlist containing only reviewed, distributable source files. 2. Permanently exclude local personalization and operational-state files, including: - `USER.md` - `IDENTITY.md` - `SOUL.md` - `TOOLS.md` - `.env*` - credential and account configuration files - private keys, certificates, and host inventories 3. Build releases in a clean staging directory rather than directly under the mutable workspace or installed Skill directory. 4. Generate and display the exact publication manifest and diff before upload. 5. Require explicit user approval for every publication. 6. Run secret scanning and sensitive-data detection over the staged package. Publication must fail closed if a possible secret is detected. 7. Validate that no symbolic links escape the staging root. 8. Separate local agent state from distributable Skill assets at the directory-architecture level. 9. Add automated tests proving that personalization, account, and infrastructure files cannot enter release artifacts. ]]>