T05 · Unauthorized Access and Privilege Escalation
Note
- Location
- scripts/generate.py:17
- Finding
- Undocumented Access to Workspace Configuration Files<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate.py`, lines 17-39 **Vulnerability Type**: Undeclared access to potentially sensitive workspace configuration **Risk Level**: Low ### Vulnerable Code ```python def get_api_key() -> str: """从环境变量或 TOOLS.md 获取 API Key""" # 1. 环境变量 key = os.environ.get("ZHIPU_API_KEY") if key: return key # 2. 从 TOOLS.md 读取 possible_paths = [ Path(__file__).parent.parent.parent.parent / "TOOLS.md", Path.cwd() / "TOOLS.md", Path("~/.openclaw/workspace/TOOLS.md"), ] for path in possible_paths: try: if path.exists(): content = path.read_text(encoding="utf-8") match = re.search(r'ZHIPU_API_KEY:\s*(\S+)', content) if match: key = match.group(1) if key and not key.startswith('请在这里'): return key except Exception: continue return None ``` ### Technical Analysis The skill metadata declares `ZHIPU_API_KEY` as a required environment variable, but the implementation also searches several `TOOLS.md` locations outside the skill directory. This behavior is not disclosed as a required permission or configuration source in the metadata. If the environment variable is absent, the script checks and reads workspace-level files using the privileges of the invoking agent. Such files may contain credentials or unrelated sensitive configuration. Reading broader workspace configuration violates least privilege because image generation only requires access to the explicitly supplied environment variable. The current source does not import the `re` module. Consequently, the regular-expression call raises `NameError`, which is silently suppressed by the broad exception handler. The file is nevertheless opened and read before that exception occurs. The current version therefore performs the undeclared file acces ...[truncated 1626 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `TOOLS.md` fallback and require `ZHIPU_API_KEY` exclusively through the declared environment variable or an approved secret-management interface. 2. If file-based configuration is genuinely required, document it in the skill metadata and request explicit user approval for one fixed configuration path. 3. Do not search parent directories or the current working directory for credentials. 4. Validate ownership and restrictive permissions before reading any credential file. 5. Catch specific expected exceptions instead of suppressing all exceptions. Avoid hiding programming errors such as the missing `re` import. 6. Never log API keys, file contents, or authorization headers. 7. Add tests confirming that the skill does not access files outside its package and explicitly approved output locations. ]]>