T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:108- Finding
Credentials Exposed Through Command-Line Arguments and Plaintext Workspace Storage
- Content
View full analysis
` | Open-platform user UUID (required) | | `jf_appKey` | `` | Application key | | `jf_secret` | `` | Application secret | | `jf_moveCard` | `7` | Move-card identifier | | `jf_authorization` | *(empty)* | User token (JWT) | | `jf_user` | `` | User ID | | `jf_device_sn` | `` | Device serial number | ``` ``` The usage examples in `SKILL.md:128-185` direct users to pass secrets and authorization tokens as command-line arguments: ```bash python ~/.openclaw/workspace/skills/jf-open-pro-ai-pet-care/scripts/pet_care.py \ --action status \ --uuid \ --appkey \ --secret \ --auth \ --user \ --sn ``` The scripts require these sensitive arguments directly. For example, `scripts/pet_care.py:146-153` contains: ```python parser.add_argument("--action", required=True, choices=["status", "switch"], help="Operation type: status=query status, switch=change switch") parser.add_argument("--sn", required=True, help="Device serial number") parser.add_argument("--user", required=True, help="User ID") parser.add_argument("--uuid", required=True, help="Open-platform user UUID") parser.add_argument("--appke ...[truncated 4749 chars]- Remediation
View remediation