T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:46- Finding
QQ Bot Secret Exposed Through Command-Line Arguments
- Content
View full analysis
--token "" ``` This stores credentials in the OpenClaw credentials store. Note: `--token-file` only sets AppSecret; you still need `appId` in config or `QQBOT_APP_ID` env var. ``` ### Technical Analysis The documented command directs the user to substitute a reusable QQ Bot application secret directly into a command-line argument. Quoting the secret only affects shell parsing; it does not prevent disclosure. Depending on the operating system, shell, and monitoring configuration, the secret may be exposed through: - Shell history files - Process listings or process-inspection interfaces while the command runs - Terminal session recordings - Command auditing and endpoint telemetry - CI/CD logs or copied troubleshooting transcripts The document mentions `--token-file`, but the shown primary command still uses the insecure `--token` argument pattern. ### Attack Path 1. A user replaces `` with the real QQ Bot secret. 2. The user executes the documented command. 3. The shell records the command in history, or local process/audit tooling captures its arguments. 4. A local user, administrator, monitoring operator, or attacker with access to those records obtains the secret. 5. The exposed credential may be used to authenticate as the associated QQ Bot, subject to the permissions and controls imposed by the QQ platform. ### Impact Assessment Successful exploitation discloses the QQ Bot application secret. The attacker does not automatically gain operating-system privileges, but may obtain the bot identity's remote API privileges and access to functionality authorized for that application. The scope is limited to the account associated ...[truncated 84 chars]- Remediation
View remediation