T09 · Insecure Skill Coding Practices
Warning
- Location
- src/cli.js:92
- Finding
- Gateway Token Exposed Through Process Command-Line Arguments<![CDATA[ ## Vulnerability Details **File Location**: `src/cli.js`, lines 59-60 and 90-98 **Vulnerability Type**: Credential exposure through process arguments and unsafe endpoint override **Risk Level**: Medium ### Vulnerable Code ```js else if (arg === "--gateway-url") parsed.gatewayUrl = next(); else if (arg === "--gateway-token") parsed.gatewayToken = next(); ``` ```js function buildGatewayArgs(options) { const toolArgs = { query: options.query, ...(options.allowedXHandles.length ? { allowed_x_handles: options.allowedXHandles } : {}), ...(options.excludedXHandles.length ? { excluded_x_handles: options.excludedXHandles } : {}), ...(options.fromDate ? { from_date: options.fromDate } : {}), ...(options.toDate ? { to_date: options.toDate } : {}), ...(options.enableImageUnderstanding ? { enable_image_understanding: true } : {}), ...(options.enableVideoUnderstanding ? { enable_video_understanding: true } : {}) }; return ["gateway", "call", "tools.invoke", "--json", "--timeout", String(options.timeoutMs), "--params", JSON.stringify({ name: "x_search", args: toolArgs }), ...(options.gatewayUrl ? ["--url", options.gatewayUrl] : []), ...(options.gatewayToken ? ["--token", options.gatewayToken] : [])]; } function runOpenClaw(spawn, env, args, options = {}) { const bin = options.openclawBin || env.X_SEARCH_OAUTH_OPENCLAW_BIN || "openclaw"; const result = spawn(bin, args, { encoding: "utf8", env, stdio: options.inherit ? "inherit" : "pipe", timeout: options.timeoutMs ?? DEFAULT_TIMEOUT_MS }); return { status: result.status ?? (result.error ? 1 : 0), stdout: result.stdout ?? "", stderr: result.stderr ?? "", error: result.error }; } ``` ### Technical Analysis The CLI accepts a sensitive OpenClaw gateway token through `--gateway-token`. This exposes the token in the wrapper process's command-line arguments. The implementation then inserts the same token into the argument array used to launch the `openclaw` child process, exposing it a second time. Depending ...[truncated 2492 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `--gateway-token` option so secrets are not accepted through command-line arguments. 2. Prefer OpenClaw's native credential configuration or an operating-system credential store. 3. If explicit token injection is necessary, read it from protected standard input, a dedicated file with restrictive permissions, or another secret-delivery channel that does not expose it in process arguments. 4. Avoid forwarding tokens to child processes through argument arrays. Use a supported protected authentication mechanism instead. 5. Require HTTPS for non-local gateway URLs. Explicitly reject plaintext remote HTTP endpoints. 6. Restrict gateway overrides to trusted origins or require an explicit confirmation before sending credentials to a non-local endpoint. 7. Redact token values from errors, diagnostics, telemetry, and debug output. 8. Document that users should never place secrets directly in shell commands and should not combine credentials with untrusted gateway URLs. 9. Add automated tests confirming that secret values never appear in spawned argument arrays, standard output, standard error, or formatted errors. ]]>