T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run_tracker.py:85- Finding
Automatic API Credential Discovery Exposes the Secret in Process Arguments
- Content
View full analysis
OpenClaw auth-profiles.json """ key = os.environ.get("OPENROUTER_API_KEY") if key: return key auth_candidates = [ os.path.expanduser("~/.openclaw/agents/main/agent/auth-profiles.json"), "/data/.openclaw/agents/main/agent/auth-profiles.json", "/root/.openclaw/agents/main/agent/auth-profiles.json", ] for auth_path in auth_candidates: if os.path.exists(auth_path): try: with open(auth_path) as f: data = json.load(f) key = data.get("profiles", {}).get("openrouter:default", {}).get("key") if key: return key except Exception: continue return None def get_openrouter_key_info(api_key): """ Fetch key info from /api/v1/auth/key. Returns dict with: usage, usage_daily, usage_weekly, usage_monthly, limit, limit_remaining. """ if not api_key: return None try: cmd = ["curl", "-s", "-H", f"Authorization: Bearer {api_key}", "https://openrouter.ai/api/v1/auth/key"] result = subprocess.run(cmd, capture_output=True, text=True, timeout=20) if result.returncode == 0: return json.loads(result.stdout).get("data", {}) except Exception: pass return None ``` The credential lookup and network request are invoked during ordinary report generation: ```python api_key = get_openrouter_api_key() ... key_info = get_openrouter_key_info(api_key) ``` ### Technical Analysis Every normal execution of `run_tracker.py` automatically searches the env ...[truncated 2219 chars]- Remediation
View remediation