T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:16
- Finding
- OAuth Token Stored in Plaintext Application Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 16–22 **Vulnerability Type**: Plaintext storage of sensitive authentication credentials **Risk Level**: Medium ### Vulnerable Code ```bash openclaw config patch '{ "env": { "vars": { "ANTHROPIC_API_KEY": "sk-ant-oat01-YOUR_TOKEN" } }, ``` Related guidance reinforces persistence of the raw token: ```markdown - Never commit `openclaw.json` with raw tokens to version control - Use `env.vars` (not inline `apiKey`) to keep tokens in one place ``` ### Technical Analysis The skill directs users to supply an Anthropic OAuth token as a literal value to `openclaw config patch`. This stores the credential in OpenClaw's persistent configuration. Referencing that value elsewhere as `${ANTHROPIC_API_KEY}` centralizes the secret but does not encrypt or otherwise protect its source value. The documented automatic redaction of `config.get` output only limits disclosure through that particular display mechanism. It does not protect the underlying configuration from direct file access, privileged local processes, malware, insecure backups, diagnostic bundles, accidental repository commits, or other file-disclosure paths. The token pattern shown in the document is a placeholder rather than a live credential. The vulnerability arises when a user replaces it with a genuine OAuth token as instructed. ### Attack Path 1. A user follows the skill and replaces `sk-ant-oat01-YOUR_TOKEN` with a valid Anthropic OAuth token. 2. `openclaw config patch` persists the literal credential in OpenClaw's configuration. 3. An attacker obtains read access to that configuration through a compromised local account, malicious process, insecure backup, accidental source-control commit, or configuration-file disclosure. 4. The attacker extracts the OAuth token. 5. The attacker attempts to reuse the token through a compatible client or OpenClaw environment until it expires or is revoked. ### Impact Assessment Success ...[truncated 539 chars]
- Remediation
- ## Remediation Suggestions 1. Do not place the literal OAuth token in any persisted OpenClaw configuration. 2. Persist only the variable reference, such as `${ANTHROPIC_API_KEY}`, and inject the actual value into the gateway process from an external secret source. 3. Prefer an operating-system credential store, managed secret service, or protected service-manager environment facility. 4. Restrict configuration and secret-file permissions to the dedicated OpenClaw service account. 5. Ensure backups, diagnostic archives, logs, shell history, and source-control workflows exclude credentials. 6. Add secret scanning for patterns such as `sk-ant-oat01-*` and reject commits containing matching credentials. 7. Document immediate revocation and rotation procedures for exposed tokens. 8. If process-environment injection is the only available option, avoid placing the token directly in shell commands that may be retained in command history. 9. Clarify that output redaction is not encryption and does not secure the underlying stored value.