Oauth Disguise

• Outcome: Review
• Latest audit: Sep 12, 2026 · 1:53 AM UTC
• Version: 1.1.1

Overview

This skill is transparent about what it does, but it teaches users to repurpose Anthropic OAuth or subscription tokens as OpenClaw API credentials and persist them in configuration.

Review this carefully before installing. Use only provider-supported API keys or officially documented authentication flows unless you have explicit authorization and understand the account and policy risk. Do not place real OAuth or subscription tokens in persistent config, shell history, logs, backups, or repositories.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (1)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:16

Finding

OAuth Token Stored in Plaintext Application Configuration

Content

View full analysis

Vulnerability Details

File Location: SKILL.md, lines 16–22
Vulnerability Type: Plaintext storage of sensitive authentication credentials
Risk Level: Medium

Vulnerable Code

bash

openclaw config patch '{
  "env": {
    "vars": {
      "ANTHROPIC_API_KEY": "sk-ant-oat01-YOUR_TOKEN"
    }
  },

Related guidance reinforces persistence of the raw token:

markdown

- Never commit `openclaw.json` with raw tokens to version control
- Use `env.vars` (not inline `apiKey`) to keep tokens in one place

Technical Analysis

The skill directs users to supply an Anthropic OAuth token as a literal value to openclaw config patch. This stores the credential in OpenClaw's persistent configuration. Referencing that value elsewhere as ${ANTHROPIC_API_KEY} centralizes the secret but does not encrypt or otherwise protect its source value.

The documented automatic redaction of config.get output only limits disclosure through that particular display mechanism. It does not protect the underlying configuration from direct file access, privileged local processes, malware, insecure backups, diagnostic bundles, accidental repository commits, or other file-disclosure paths.

The token pattern shown in the document is a placeholder rather than a live credential. The vulnerability arises when a user replaces it with a genuine OAuth token as instructed.

Attack Path

1. A user follows the skill and replaces sk-ant-oat01-YOUR_TOKEN with a valid Anthropic OAuth token.
2. openclaw config patch persists the literal credential in OpenClaw's configuration.
3. An attacker obtains read access to that configuration through a compromised local account, malicious process, insecure backup, accidental source-control commit, or configuration-file disclosure.
4. The attacker extracts the OAuth token.
5. The attacker attempts to reuse the token through a compatible client or OpenClaw environment until it expires or is revoked.

Impact Assessment

Success ...[truncated 539 chars]

Remediation

View remediation

Remediation Suggestions

1. Do not place the literal OAuth token in any persisted OpenClaw configuration.
2. Persist only the variable reference, such as ${ANTHROPIC_API_KEY}, and inject the actual value into the gateway process from an external secret source.
3. Prefer an operating-system credential store, managed secret service, or protected service-manager environment facility.
4. Restrict configuration and secret-file permissions to the dedicated OpenClaw service account.
5. Ensure backups, diagnostic archives, logs, shell history, and source-control workflows exclude credentials.
6. Add secret scanning for patterns such as sk-ant-oat01-* and reject commits containing matching credentials.
7. Document immediate revocation and rotation procedures for exposed tokens.
8. If process-environment injection is the only available option, avoid placing the token directly in shell commands that may be retained in command history.
9. Clarify that output redaction is not encryption and does not secure the underlying stored value.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Natural-Language Policy Violations

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The skill explicitly promotes using OAuth subscription tokens as API keys and describes this as a way to make tokens that normally fail direct API calls work through another tool. That is a clear attempt to bypass intended authentication and product boundaries, enabling unauthorized access patterns and possible abuse of paid subscription credentials.

Content

No source excerpt is available for this finding.

Ssd 2

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

This content is a workaround for converting consumer/subscription OAuth tokens into effective API credentials via environment-variable injection and provider configuration. The context makes it more dangerous because it is not abstract discussion; it is operational, step-by-step enablement for crossing an access-control boundary that the provider appears to enforce.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 94% confidence

Finding

The skill gives concrete instructions for inserting a live OAuth-style token into configuration and environment variables without leading safety guidance about credential exposure, account misuse, or provider policy risk. Even though it briefly says not to commit raw tokens, the overall flow encourages handling high-value secrets in a way that could lead to leakage or unauthorized use.

Content

No source excerpt is available for this finding.