T05 · Unauthorized Access and Privilege Escalation
Error
- Location
nim_ensemble/voter.py:50- Finding
Cross-Agent GitHub Credential Discovery and Automatic Reuse
- Content
View full analysis
bool: """Refresh the Copilot session token using GitHub OAuth token. Uses the stored GitHub user token (ghu_*) to request a fresh Copilot session token from api.github.com/copilot_internal/v2/token. """ import urllib.request import urllib.error import glob token_path = os.path.expanduser( "~/.openclaw/credentials/github-copilot.token.json" ) # Find GitHub OAuth token from auth-profiles oauth_token = None for profile_path in glob.glob( os.path.expanduser("~/.openclaw/agents/*/agent/auth-profiles.json") ): try: with open(profile_path) as f: data = json.load(f) profiles = data.get("profiles", data) for profile_name, profile_data in profiles.items(): if isinstance(profile_data, dict): tok = profile_data.get("token", "") if isinstance(tok, str) and tok.startswith("ghu_"): oauth_token = tok break if oauth_token: break except Exception: continue if not oauth_token: return False try: req = urllib.request.Request( "https://api.github.com/copilot_internal/v2/token", headers={ "Authorization": f"token {oauth_token}", "Editor-Version": "vscode/1.96.0", "Editor-Plugin-Version": "copilot/1.250.0", "User-Agent": "GithubCopilot/1.250.0", }, ) with urllib.request.urlopen(req, timeout=10) as resp: data = json.loads(resp.read().decode("utf-8")) if "token" not in data: return False with open(to ...[truncated 2205 chars]- Remediation
View remediation