T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.py:15
- Finding
- Hard-Coded NextCloud Credentials Transmitted over Plaintext HTTP## Vulnerability Details **File Location**: `SKILL.py:15-18`, `SKILL.py:100-109`, `SKILL.md:29-35`, `SKILL.md:210-216` **Vulnerability Type**: Hard-coded secret and plaintext credential transmission **Risk Level**: High ### Vulnerable Code `SKILL.py:15-18`: ```python NEXTCLOUD_USER = os.environ.get('NEXTCLOUD_USER', 'openclaw') NEXTCLOUD_PASS = os.environ.get('NEXTCLOUD_PASS', 'N95qg-Wzdpc-6DJAn-xMaHa-RaEW5') NEXTCLOUD_URL = os.environ.get('NEXTCLOUD_URL', 'http://192.168.68.68:8080') FISH_AUDIO_S1_URL = os.environ.get('FISH_AUDIO_S1_URL', 'http://192.168.68.78:7860') ``` `SKILL.py:100-109`: ```python with open(audio_file_path, 'rb') as f: nextcloud_url = f"{NEXTCLOUD_URL}/remote.php/webdav/Openclaw/{filename}" response = requests.put( nextcloud_url, auth=(NEXTCLOUD_USER, NEXTCLOUD_PASS), timeout=120 ) ``` `SKILL.md:29-35`: ```bash export NEXTCLOUD_USER="openclaw" export NEXTCLOUD_PASS="N95qg-Wzdpc-6DJAn-xMaHa-RaEW5" export NEXTCLOUD_URL="http://192.168.68.68:8080" export FISH_AUDIO_S1_URL="http://192.168.68.78:7860" ``` `SKILL.md:210-216`: ```bash # Configuration NEXTCLOUD_USER="${NEXTCLOUD_USER:-openclaw}" NEXTCLOUD_PASS="${NEXTCLOUD_PASS:-N95qg-Wzdpc-6DJAn-xMaHa-RaEW5}" NEXTCLOUD_URL="${NEXTCLOUD_URL:-http://192.168.68.68:8080}" FISH_AUDIO_S1_URL="${FISH_AUDIO_S1_URL:-http://192.168.68.78:7860}" ``` ### Technical Analysis A reusable NextCloud username and password are embedded in both executable code and documentation. When the relevant environment variables are absent, the Python implementation silently falls back to these exposed credentials. The configured NextCloud URL uses unencrypted HTTP. The `requests.put` call applies HTTP Basic authentication through the `auth` parameter. Basic authentication only encodes credentials and does not encrypt them. Without TLS, a network-positioned attacker can observe the Authorization hea ...[truncated 1464 chars]
- Remediation
- ## Remediation Suggestions 1. Immediately rotate the exposed NextCloud password and invalidate any active credentials or application tokens derived from it. 2. Remove the credential from executable code, documentation, examples, repository history, packaged artifacts, and logs. 3. Do not provide a secret as an environment-variable fallback. Require explicit secret configuration and fail closed when it is absent: ```python NEXTCLOUD_USER = os.environ.get("NEXTCLOUD_USER") NEXTCLOUD_PASS = os.environ.get("NEXTCLOUD_PASS") NEXTCLOUD_URL = os.environ.get("NEXTCLOUD_URL") if not all((NEXTCLOUD_USER, NEXTCLOUD_PASS, NEXTCLOUD_URL)): raise RuntimeError("Required NextCloud configuration is missing") ``` 4. Store credentials in a dedicated secret manager, operating-system credential store, or securely scoped runtime secret injection mechanism. 5. Require an `https://` NextCloud endpoint with certificate verification enabled. Do not provide an HTTP fallback. 6. Prefer a revocable, narrowly scoped application password rather than the user's primary password. 7. Restrict the service account to the minimum required directory and operations. 8. Add automated secret scanning and configuration checks to prevent credentials and plaintext service URLs from being committed again.