T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/send_line.py:7
- Finding
- Unnecessary Secret-File Discovery and Partial Credential Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `scripts/send_line.py`, lines 7–24, 31–53, and 71–73 **Vulnerability Type**: Sensitive configuration access and credential disclosure **Risk Level**: Medium ### Vulnerable Code ```python def get_openclaw_config(): """ Attempts to find OpenClaw / Moltbot configuration or secrets. """ paths = [ Path("C:/Users/user/.openclaw/openclaw.json"), Path.home() / ".openclaw" / "secrets.json", Path.home() / ".openclaw" / "config.json", Path.home() / ".moltbot" / "secrets.json", ] for p in paths: if p.exists(): try: with open(p, 'r') as f: return json.load(f) except Exception: pass return {} ``` ```python def send_to_line(file_path, channel_access_token=None, user_id=None): """ Sends a file to a LINE user using the Messaging API. """ config = get_openclaw_config() # Helper to find nested keys def find_key(cfg, key_name): if key_name in cfg: return cfg[key_name] for v in cfg.values(): if isinstance(v, dict): res = find_key(v, key_name) if res: return res return None # Priority: Argument > Environment Variable > Config File (Flat or Nested) token = (channel_access_token or os.environ.get("LINE_CHANNEL_ACCESS_TOKEN") or find_key(config, "LINE_CHANNEL_ACCESS_TOKEN") or find_key(config, "line_token") or find_key(config, "channelAccessToken")) to_user = (user_id or os.environ.get("LINE_USER_ID") or find_key(config, "LINE_USER_ID") or find_key(config, "line_user_id") or find_key(config, "userId")) ``` ```python print(f"Credentials Found:") print(f" - Token: {token[:5]}...{token[-5:] if len(token)>10 else ''}") print(f" - Target User: {to_user}") ``` ### Technical An ...[truncated 2476 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove automatic probing of OpenClaw and Moltbot secret files. 2. Accept credentials only through an explicit, documented, and narrowly scoped secure configuration interface. 3. Never print access-token prefixes, suffixes, full tokens, recipient identifiers, or other credential-related values. 4. Validate the requested file, its type, and its size before accessing any credentials. 5. Replace recursive searches for generic keys such as `userId` with strict schema validation and exact configuration paths. 6. If direct LINE transmission is required, implement it through an approved API flow with narrowly scoped credentials and clear failure reporting. 7. If the OpenClaw bridge is the intended transfer mechanism, remove credential handling from this helper entirely and return only the validated local path through the documented bridge interface. 8. Use structured error handling that does not silently suppress configuration parsing errors and does not expose secret values. ]]>