T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:2
- Finding
- Unnecessary Sensitive Credential Requirement in Misleading Skill Metadata## Vulnerability Details **File Location**: `SKILL.md`, lines 2–11 **Vulnerability Type**: Violation of least privilege through an unnecessary credential requirement **Risk Level**: Medium ### Vulnerable Code ```yaml name: musa-torch-coding description: Transcribe audio via OpenAI Audio Transcriptions API (Whisper). homepage: https://platform.openai.com/docs/guides/speech-to-text metadata: { "openclaw": { "emoji": "☁️", "requires": { "bins": ["curl"], "env": ["OPENAI_API_KEY"] }, "primaryEnv": "OPENAI_API_KEY", }, } ``` ### Technical Analysis The metadata declares that the Skill requires the `OPENAI_API_KEY` environment variable and the `curl` executable. It also describes the Skill as an OpenAI audio transcription integration. However, the substantive Skill documentation and executable files implement MUSA GPU guidance, CUDA-to-MUSA source conversion, and a MUSA-compatible YOLO template. None of the reviewed executable code uses `OPENAI_API_KEY`, `curl`, or the OpenAI API. Requiring a sensitive credential that is unrelated to the implemented functionality violates the principle of least privilege. A compatible host may provision the API key into the Skill's execution environment solely because the metadata declares it as required. The metadata inconsistency is security-relevant because it unnecessarily expands the set of secrets available in the Skill context. The reviewed project contains no code that reads, transmits, or otherwise exfiltrates the key, so active credential theft is not established. ### Attack Path 1. A user or automation platform installs or loads the Skill. 2. The platform processes the `openclaw.requires.env` and `primaryEnv` declarations. 3. To satisfy those declarations, the platform makes `OPENAI_API_KEY` available to the Skill execution context. 4. The Skill performs MUSA-related operations that do not require this credential. 5. T ...[truncated 900 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the unrelated credential and executable requirements: ```yaml metadata: { "openclaw": { "emoji": "☁️", }, } ``` 2. Remove `primaryEnv: "OPENAI_API_KEY"` unless the Skill gains a documented feature that genuinely requires the OpenAI API. 3. Replace the audio-transcription description and OpenAI homepage with accurate MUSA/PyTorch metadata. 4. Declare only dependencies required by the implemented functionality, such as Python and the expected MUSA libraries where appropriate. 5. Add automated metadata validation that compares declared environment variables and executables against actual code usage. 6. Configure the hosting platform to require explicit user approval before exposing credentials to a Skill, even when its metadata requests them. 7. If OpenAI functionality is intentionally added later, isolate it as an optional capability and grant a narrowly scoped, revocable key only when that capability is invoked.