T09 · Insecure Skill Coding Practices
- Location
scripts/gateway-watchdog.sh:201- Finding
Spark Bearer Token Can Be Disclosed to an Arbitrary Configured Endpoint
- Content
View full analysis
Vulnerability Details
File Location:
scripts/gateway-watchdog.sh, lines 14, 58–65, and 201–213
Vulnerability Type: Credential disclosure through an unrestricted destination
Risk Level: HighVulnerable Code
bash OPENCLAW_ENV_FILE="${OPENCLAW_ENV_FILE:-$HOME/.openclaw/.env}"bash for key in \ DISCORD_WEBHOOK_URL DISCORD_BOT_TOKEN DISCORD_CHANNEL_ID \ SPARK_API_URL SPARK_API_TOKEN LOCAL_API_URL DASHBOARD_PORT \ GW_WATCHDOG_FAIL_THRESHOLD GW_WATCHDOG_COOLDOWN_SECONDS \ GW_WATCHDOG_HEALTH_TIMEOUT_MS GW_WATCHDOG_LOCK_TIMEOUT_SECONDS; do if value=$(read_env_value "$key" "$CONFIG_ENV_FILE" 2>/dev/null); then printf -v "$key" '%s' "$value" export "$key" fi donebash check_spark() { local spark_api="${SPARK_API_URL:-http://127.0.0.1:17070}" local spark_token="${SPARK_API_TOKEN:-}" local response local curl_args=(-fsS --max-time 5 -H "Accept: application/json") if [[ -z "$spark_token" ]]; then spark_token=$(read_env_value "SPARK_API_TOKEN" "$OPENCLAW_ENV_FILE" 2>/dev/null || true) fi if [[ -n "$spark_token" ]]; then curl_args+=(-H "Authorization: Bearer ${spark_token}") fi if ! response=$(curl "${curl_args[@]}" "${spark_api}/status" 2>/dev/null); then echo "fail" return fiTechnical Analysis
The watchdog automatically reads
SPARK_API_TOKENfrom the general OpenClaw environment file when the token is not otherwise configured. It then attaches that credential as a bearer token to a request directed bySPARK_API_URL.Although the default URL is loopback-only,
SPARK_API_URLcan be supplied through the process environment or the watchdog'sconfig.env. The code does not validate the destination scheme, hostname, resolved address, port, or origin before transmitting the credential. Consequently, an HTTP or HTTPS endpoint controlled by an attacker can receive the token.Parsing
.env...[truncated 1889 chars]- Remediation
View remediation
Remediation Suggestions
- Enforce loopback destinations by default. Parse
SPARK_API_URLand reject hosts other than127.0.0.1,::1, or an explicitly approved local hostname. - If remote Spark endpoints are required, introduce a separate explicit opt-in and require HTTPS with certificate verification.
- Bind each bearer token to a configured, allowlisted origin. Do not attach a token after redirects to a different origin; explicitly disable redirects or validate every redirect target.
- Remove automatic fallback to the general
~/.openclaw/.envfile. Prefer an explicitSPARK_API_TOKENenvironment variable or a dedicated token file with restrictive permissions. - Validate configuration ownership and permissions before reading secrets, and reject user-writable configuration that is accessible by other accounts.
- Consider separate options for authenticated and unauthenticated checks so an endpoint override cannot implicitly trigger credential transmission.
- Add tests confirming that bearer tokens are never sent to non-loopback HTTP endpoints or unapproved origins.
- Enforce loopback destinations by default. Parse