T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/fetch_feishu_messages.sh:9
- Finding
- Feishu application secret exposed through Agent output and process arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:20-30`; `scripts/fetch_feishu_messages.sh:9-16` **Vulnerability Type**: Credential exposure through command output and process arguments **Risk Level**: Medium ### Vulnerable Code ```bash # SKILL.md:20-30 2. From the OpenClaw configuration, obtain the Feishu app_id and app_secret: ```bash grep -E "appId|appSecret" ~/.openclaw/openclaw.json ``` 3. Obtain the current chat_id from the inbound context. 4. Calculate timestamps and execute the retrieval script: ```bash START_TS=$(python3 -c "import datetime; d=datetime.datetime(2026,2,24,0,0,tzinfo=datetime.timezone(datetime.timedelta(hours=8))); print(int(d.timestamp()))") END_TS=$(python3 -c "import datetime; d=datetime.datetime(2026,2,28,23,59,59,tzinfo=datetime.timezone(datetime.timedelta(hours=8))); print(int(d.timestamp()))") bash <skill_dir>/scripts/fetch_feishu_messages.sh <app_id> <app_secret> <chat_id> $START_TS $END_TS ``` ``` ```bash # scripts/fetch_feishu_messages.sh:9-16 APP_ID="${1:?Usage: $0 <app_id> <app_secret> <chat_id> <start_ts_s> <end_ts_s>}" APP_SECRET="${2:?}" CHAT_ID="${3:?}" START_TS="${4:?}" END_TS="${5:?}" TOKEN=$(curl -s -X POST 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' \ -H 'Content-Type: application/json' \ -d "{\"app_id\":\"${APP_ID}\",\"app_secret\":\"${APP_SECRET}\"}" \ | python3 -c "import sys,json; print(json.load(sys.stdin).get('tenant_access_token',''))") ``` ### Technical Analysis The Skill instructs the Agent to use `grep` without suppressing output to extract `appId` and `appSecret`. This can place the secret in the Agent transcript, tool output, execution logs, or other retained telemetry. The secret is then supplied as a positional command-line argument to the shell script. On systems where process metadata is visible to other users or monitoring software, the script's command line can be read from process inspection interfaces such as `/proc/<pi ...[truncated 1848 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not print secrets into Agent or tool output. Replace the documented `grep` command with a dedicated credential-loading mechanism that extracts only the required values without displaying them. 2. Prefer a credential broker, secret manager, or narrowly scoped helper process that performs authentication without returning the application secret to the Agent. 3. Do not pass `app_secret` as a positional command-line argument. Read it from a permission-restricted file descriptor or standard input. 4. Send the JSON request body to curl through standard input so it is not present in curl's argument vector. For example: ```bash TOKEN=$( python3 - "$APP_ID" <<'PY' | curl --fail-with-body --silent --show-error \ -X POST \ -H 'Content-Type: application/json' \ --data-binary @- \ 'https://open.feishu.cn/open-apis/auth/v3/tenant_access_token/internal' import json import os import sys print(json.dumps({ "app_id": sys.argv[1], "app_secret": os.environ["FEISHU_APP_SECRET"] })) PY ) ``` The environment is still potentially observable on some systems, so a secret manager or inherited file descriptor is preferable for higher-assurance deployments. 5. Ensure `~/.openclaw/openclaw.json` has restrictive filesystem permissions and never include its secret fields in logs. 6. Rotate the existing application secret if the documented workflow has already been used in environments with retained command output. 7. Restrict the Feishu application's scopes to the minimum message-read permissions required for the weekly-report workflow. ]]>