T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:14- Finding
API Credential Stored Without Restrictive File Permissions
- Content
View full analysis
"$CONFIG_DIR/bocha-search.json" << JSON { "apiKey": "$API_KEY" } JSON ``` ### Technical Analysis The setup script writes the Bocha API key in plaintext without establishing restrictive permissions on either the configuration directory or the credential file. The permissions are inherited from the user's current `umask`. Under a permissive configuration, other local users or processes may be able to read the file. The documented setup mechanism also passes the API key as a command-line argument: ```bash ~/.openclaw/skills/bocha-search/scripts/setup.sh YOUR_API_KEY ``` Command-line secrets may be retained in shell history and can be temporarily visible through local process-inspection interfaces. ### Attack Path 1. A user runs the documented setup command with the API key as an argument. 2. The command may be recorded in the user's shell history or exposed through process inspection while running. 3. The script creates `bocha-search.json` using permissions determined by the existing `umask`. 4. A local user or process with access to the history, process metadata, or insufficiently protected file reads the credential. 5. The attacker uses the stolen key to authenticate to the Bocha API. ### Impact Assessment Successful exploitation exposes the user's Bocha API credential. An attacker could submit API requests as the victim, consume the victim's quota, incur costs associated with the account, or access capabilities granted to that key. This issue does not independently grant elevated operating-system privileges. Its scope is limited to local principals capable of reading the exposed command or file and to the permissions associated with the compromised API key. ]]>- Remediation
View remediation
"$tmp_file" chmod 600 "$tmp_file" mv "$tmp_file" "$CONFIG_DIR/bocha-search.json" ``` 5. Update the documentation so it does not recommend placing API credentials directly on the command line. ]]>