T09 · Insecure Skill Coding Practices
Error
- Location
scripts/sync-runtime-to-artifact.sh:18- Finding
Unattended publication can expose personal, infrastructure, and sensitive workspace data
- Content
View full analysis
/dev/null 2>&1 || true rm -f "${ARTIFACT_AGENT_DIR}/.publish-state.json" >/dev/null 2>&1 || true rm -f "${ARTIFACT_AGENT_DIR}/.publish-now" >/dev/null 2>&1 || true rsync -a --delete \ --exclude '.openclaw/' \ --exclude '.git/' \ --exclude 'memory/' \ --exclude '.publish-state.json' \ --exclude '.publish-now' \ --exclude '**/.venv/' \ --exclude '**/__pycache__/' \ --exclude '**/*.pyc' \ --exclude '**/*.pyo' \ --exclude '**/.DS_Store' \ --exclude 'logs/' \ --exclude 'tmp/' \ "${RUNTIME_DIR}/" \ "${ARTIFACT_AGENT_DIR}/" # Record which runtime commit this artifact was synced from if command -v git >/dev/null 2>&1 && [[ -d "${RUNTIME_DIR}/.git" ]]; then (cd "${RUNTIME_DIR}" && git rev-parse HEAD) > "${ARTIFACT_AGENT_DIR}/.runtime-head" || true fi ``` The synchronized artifact is subsequently published: ```bash cd "${SKILL_DIR}" echo "Publishing ${SLUG}@${version} ..." # Best-effort: publishing may fail if not logged in; do not crash the whole system. # clawhub publish can occasionally timeout; retry a few times. try=1 max=3 ok="false" while [[ ${try} -le ${max} ]]; do echo "Publish attempt ${try}/${max}..." if "${CLAWHUB_BIN}" publish . --slug "${SLUG}" --name "${NAME}" --version "${version}" --changelog "${changelog}"; then ok="true"; break fi sleep $((try * 5)) try=$((try + 1)) done if [[ "${ok}" == "true" ]]; then mkdir -p "$(dirname "${STATE_FILE}")" node -e 'const fs=require("fs"); const p=process.ar ...[truncated 2940 chars]- Remediation
View remediation