T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:44
- Finding
- AgentMail API key file is created without restrictive permissions<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 44-46 **Vulnerability Type**: Insecure secret-file permissions **Risk Level**: Medium ### Vulnerable Code ```bash cat > ~/.openclaw/workspace/agentmail/.env << 'EOF' AGENTMAIL_API_KEY=am_us_..... EOF ``` ### Technical Analysis The setup instructions write the AgentMail API key to a plaintext `.env` file without explicitly setting restrictive file permissions. The resulting permissions depend on the user's current `umask`. With a common `022` umask, the file can be created with mode `0644`, making it readable by other local users if they can traverse the parent directories. The API key is legitimately required for the declared email functionality, but making it potentially accessible outside the Agent account exceeds the minimum access necessary. This is a local credential-disclosure risk rather than evidence that the Skill intentionally transmits the key to an unrelated service. ### Attack Path 1. A user follows the documented setup instructions under a permissive `umask`. 2. The shell creates `.env` with group-readable or world-readable permissions. 3. Another local account traverses the workspace path and reads the `.env` file. 4. The attacker extracts `AGENTMAIL_API_KEY`. 5. The attacker authenticates to AgentMail using the stolen credential. 6. Subject to the API key's server-side permissions, the attacker reads mailbox data or sends messages as the configured inbox. ### Impact Assessment Successful exploitation discloses the AgentMail API credential. The attacker may gain the mailbox privileges granted to that key, potentially including access to email content and metadata, modification of message state, and the ability to send messages as the configured inbox. The scope is limited by local filesystem accessibility and the permissions assigned to the API key. This issue does not itself grant operating-system privilege escalation. ]]>
- Remediation
- <![CDATA[ ## Remediation Suggestions Create the secret file with owner-only permissions and ensure its parent directory is also private. For example: ```bash DEST="$HOME/.openclaw/workspace/agentmail" mkdir -p "$DEST" chmod 700 "$DEST" umask 077 cat > "$DEST/.env" << 'EOF' AGENTMAIL_API_KEY=am_us_..... EOF chmod 600 "$DEST/.env" ``` Additional hardening measures: - Prefer injecting the key through a dedicated secret manager or protected runtime environment rather than storing it in a project file. - Verify ownership before reading the file. - Exclude `.env` from source control and backups that are not approved for secrets. - Rotate the API key if the file was previously created with permissive permissions. - Restrict the API key server-side to only the mailbox operations required by this Skill. ]]>