Secret Manager

• Outcome: Review
• Latest audit: Sep 10, 2026 · 11:08 AM UTC
• Version: 1.0.0

Overview

The skill does manage OpenClaw secrets, but it also executes a configurable secrets file and performs service/process recovery actions that need careful review before installation.

Review this before installing. Prefer interactive or stdin secret entry, avoid passing secrets as command arguments, do not use SECRETS_ENV_FILE unless you fully control and audit that file, and expect the script to modify OpenClaw config and restart or force-stop gateway processes. The skill is not classified as malicious because the main behavior is disclosed and there is no evidence of exfiltration, remote payloads, or hidden persistence, but its current implementation has real safety and scoping issues.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: secret-manager.sh:168

Finding

Arbitrary Shell Command Execution Through a Configurable Secrets File

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: secret-manager.sh:109

Finding

Credentials Exposed Through Command-Line Arguments

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: secret-manager.sh:76

Finding

Secret Prefixes and Exact Lengths Disclosed by the List Command

Content

View full analysis

/dev/null || true)" if [ -n "$val" ]; then echo " $key = ${val:0:8}... (${#val} chars)" else echo " $key = (not set)" fi done } ``` ### Technical Analysis The `list` operation retrieves each complete secret from GNOME Keyring and prints its first eight characters together with its exact length. Credential prefixes can identify providers, token formats, environments, or specific credentials. Exact lengths provide additional information useful for correlation and validation. This output may be copied into support tickets, retained in terminal scrollback, captured in screenshots, or collected by session-recording and logging systems. A list operation only needs to report whether a credential exists; disclosing any part of its value is unnecessary. ### Attack Path 1. A user runs: ```bash ./secret-manager.sh list ``` 2. The script retrieves each configured credential from GNOME Keyring. 3. It emits the first eight characters and exact length of every configured value. 4. An attacker obtains the output through shoulder surfing, terminal logs, screenshots, copied diagnostic output, or session recordings. 5. The attacker uses the leaked metadata to identify or correlate credentials and to reduce uncertainty during credential discovery or validation. This finding is an information disclosure rather than a standalone method for recovering a complete high-entropy credential. ### Impact Assessment The issue leaks partial credential material and metadata for every configured secret accessible t ...[truncated 267 chars]

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Tool Misuse: Tool Parameter Abuse, Chaining Abuse, Unsafe Defaults
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration

Findings (20)

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The declared description frames the skill as secure key management, but the documented behavior extends into sourcing external env files, listing secrets with partial disclosure, altering systemd user environment, restarting services, interacting with a container, and manipulating runtime lock files. This mismatch is dangerous because users and automated systems may grant trust based on the narrow description while the skill actually performs privileged operational actions that can expose secrets or disrupt services.

Content

No source excerpt is available for this finding.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Referencing a .env secrets file for credential handling weakens the security model advertised by the skill because secrets may reside in plaintext on disk or be loaded unsafely. In the context of a secret-management skill, this is more dangerous because users are primed to assume strong secret hygiene while the design introduces an alternate, less secure secret source.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

| :--- | :--- | :--- |
| `OPENCLAW_CONTAINER` | Name of the Distrobox container | `clawdbot` |
| `OPENCLAW_HOME` | Path to OpenClaw config directory | `~/.openclaw` |
| `SECRETS_ENV_FILE` | Path to an optional .env file to source | `~/.config/openclaw/secrets.env` |

## Usage

Credential Access

High

• Category: Privilege Escalation
• Confidence: 88% confidence

Finding

Referencing a .env secrets file for credential handling weakens the security model advertised by the skill because secrets may reside in plaintext on disk or be loaded unsafely. In the context of a secret-management skill, this is more dangerous because users are primed to assume strong secret hygiene while the design introduces an alternate, less secure secret source.

Content

Scanner excerpt · SKILL.md (reported line 35)May include surrounding context.

md

| :--- | :--- | :--- |
| `OPENCLAW_CONTAINER` | Name of the Distrobox container | `clawdbot` |
| `OPENCLAW_HOME` | Path to OpenClaw config directory | `~/.openclaw` |
| `SECRETS_ENV_FILE` | Path to an optional .env file to source | `~/.config/openclaw/secrets.env` |

## Usage

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret-manager.sh (reported line 3)May include surrounding context.

sh

#!/bin/bash
# secret-manager
# Securely manage API keys in GNOME Keyring and inject them into OpenClaw configuration.
#
# Usage:
#   secret-manager <KEY_NAME> [value]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret-manager.sh (reported line 23)May include surrounding context.

sh

#!/bin/bash
# secret-manager
# Securely manage API keys in GNOME Keyring and inject them into OpenClaw configuration.
#
# Usage:
#   secret-manager <KEY_NAME> [value]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret-manager.sh (reported line 62)May include surrounding context.

sh

#!/bin/bash
# secret-manager
# Securely manage API keys in GNOME Keyring and inject them into OpenClaw configuration.
#
# Usage:
#   secret-manager <KEY_NAME> [value]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret-manager.sh (reported line 126)May include surrounding context.

sh

#!/bin/bash
# secret-manager
# Securely manage API keys in GNOME Keyring and inject them into OpenClaw configuration.
#
# Usage:
#   secret-manager <KEY_NAME> [value]

Credential Access

High

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · secret-manager.sh (reported line 21)May include surrounding context.

sh

CONTAINER_NAME="${OPENCLAW_CONTAINER:-clawdbot}"
OPENCLAW_DIR="${OPENCLAW_HOME:-$HOME/.openclaw}"
AUTH_PROFILES="$OPENCLAW_DIR/agents/main/agent/auth-profiles.json"
SECRETS_FILE="${SECRETS_ENV_FILE:-$HOME/.config/openclaw/secrets.env}"

# Key Definition: Env Var Name -> Keyring Service Name
declare -A SERVICES LABELS

Context-Inappropriate Capability

High

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

The script executes source "$SECRETS_FILE" on a path controlled by the environment variable SECRETS_ENV_FILE or a default file in the user's home directory. Sourcing is code execution in Bash, so any shell commands in that file run with the user's privileges, which exceeds the stated secret-management purpose and creates an arbitrary code execution path.

Content

No source excerpt is available for this finding.

Tool Parameter Abuse

High

• Category: Tool Misuse
• Confidence: 95% confidence

Finding

Tool parameters are crafted to achieve unintended or unsafe behavior. Parameter abuse can bypass intended safety checks (e.g. shell=True, --force, dangerous glob patterns).

Content

Scanner excerpt · secret-manager.sh (reported line 187)May include surrounding context.

sh

pkill -9 -f "openclaw$" 2>/dev/null
        sleep 1
        # Dynamic user ID path
        rm -f "/tmp/openclaw-$(id -u)/gateway.*.lock" 2>/dev/null
    ' 2>/dev/null || true
fi
sleep 2

Undeclared Tool Scope

Medium

• Category: MCP Least Privilege
• Confidence: 85% confidence

Finding

The skill advertises installation metadata but does not declare an explicit tool or permission scope, while the described behavior includes writing configuration and modifying runtime state. Without clear scope boundaries, an agent may be allowed to perform broader file-modifying actions than a user expects, increasing the risk of unintended secret exposure or config tampering.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 21)May include surrounding context.

md

## Installation

Ensure you have the dependencies:
- **Debian/Ubuntu:** `sudo apt install libsecret-tools`
- **Fedora:** `sudo dnf install libsecret`
- **Arch:** `sudo pacman -S libsecret`

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 22)May include surrounding context.

md

## Installation

Ensure you have the dependencies:
- **Debian/Ubuntu:** `sudo apt install libsecret-tools`
- **Fedora:** `sudo dnf install libsecret`
- **Arch:** `sudo pacman -S libsecret`

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 70% confidence

Finding

Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Content

Scanner excerpt · SKILL.md (reported line 23)May include surrounding context.

md

## Installation

Ensure you have the dependencies:
- **Debian/Ubuntu:** `sudo apt install libsecret-tools`
- **Fedora:** `sudo dnf install libsecret`
- **Arch:** `sudo pacman -S libsecret`

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The usage example encourages passing secrets directly on the command line without warning that such values may be recorded in shell history, process listings, logs, or audit trails. This can leak API keys to other local users, support tooling, or future forensic review even if the final storage mechanism is secure.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The script copies secrets from GNOME Keyring into auth-profiles.json in plaintext without warning the user that the secret leaves the keyring boundary. That increases exposure through filesystem reads, backups, editor history, permissive file permissions, and other local processes that can access the config file.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 99% confidence

Finding

Sourcing an external env file is not just loading configuration; it executes arbitrary shell contained in that file. Without an explicit warning or validation, a user may reasonably assume the file is treated as data, making this a dangerous and surprising execution path.

Content

No source excerpt is available for this finding.

Description-Behavior Mismatch

Medium

• Category: Not specified by scanner
• Confidence: 92% confidence

Finding

The script performs service control (systemctl stop/start) and process cleanup in addition to secret storage. While not inherently malicious, this broadens the blast radius of the tool: invoking a secret update can disrupt user services, restart daemons with unintended state, and create side effects unrelated to credential management.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The distrobox block force-kills processes with pkill -9 -f and deletes lock files inside a container as part of normal secret management. These are destructive recovery actions not justified by the advertised purpose, and they can terminate unrelated matching processes or corrupt state by bypassing graceful shutdown.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

The script uses pkill -9 and removes lock files silently as part of restart handling. These actions can cause data loss, incomplete writes, or service instability, and the absence of an explicit warning makes the behavior more dangerous because users may not expect destructive recovery steps from a secret manager.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.