T09 · Insecure Skill Coding Practices
Error
- Location
scripts/run_command.sh:111- Finding
API Key Exposed in Default Request Logs
- Content
View full analysis
/dev/null 2>&1 || true return 0 fi python3 -c " import os, sys, shlex url = sys.argv[1] body = sys.stdin.read() ak = os.environ.get('DESIGNKIT_OPENCLAW_AK', '') or '' parts = [ 'curl', '-s', '-w', '\\n%{http_code}', '-X', 'POST', '-H', 'Content-Type: application/json', '-H', 'X-Openclaw-AK: ' + ak, '-d', body, '--max-time', '120', url, ] print('[REQUEST] ' + shlex.join(parts), file=sys.stderr) " "$url" } ``` `scripts/run_command.sh:449`: ```bash printf '%s' "$BODY" | request_log_openclaw_curl "${API_BASE_NORMALIZED}${ENDPOINT}" ``` `scripts/ecommerce_product_kit.py:40-66`: ```python def _request_log_enabled() -> bool: return os.environ.get("OPENCLAW_REQUEST_LOG", "1") != "0" def _request_log_as_curl( method: str, url: str, headers: Dict[str, str], data: Optional[bytes] = None, ) -> None: if not _request_log_enabled(): return parts: List[str] = ["curl", "-s", "--max-time", "120"] m = method.upper() if m not in ("GET", "HEAD"): parts.extend(["-X", m]) for k, v in headers.items(): parts.extend(["-H", f"{k}: {v}"]) if data: parts.extend(["-d", data.decode("utf-8", errors="replace")]) parts.append(url) print("[REQUEST] " + shlex.join(parts), file=sys.stderr) ``` `scripts/ecommerce_product_kit.py:296-304,332`: ```python def _headers_json() -> Dict[str, str]: ak = _require_ak() return { "Accept": "application/json, text/plain, */*", ...[truncated 1755 chars]- Remediation
View remediation
" if key.lower() in REDACTED_HEADERS else value parts.extend(["-H", f"{key}: {safe_value}"]) ``` 3. Apply equivalent redaction in `request_log_openclaw_curl`; do not read the API key merely to print it. 4. Redact tokens, signed URLs, image URLs, and sensitive body fields from response and request-body logs. 5. Limit debug logs to metadata such as method, approved hostname, path, response code, and request ID. 6. Review existing logs and rotate any API key that may already have been recorded. ]]>