T09 · Insecure Skill Coding Practices
Warning
- Location
- prompts/init.md:18
- Finding
- Insecure API Credential Handling in Documentation## Vulnerability Details **File Location**: `prompts/init.md:18-20`; `README.md:68-75` **Vulnerability Type**: Plaintext credential exposure and insecure secret handling **Risk Level**: Medium ### Vulnerable Code Snippets `prompts/init.md:18-20`: ```markdown ### 推荐方式：baidu-search（首选） ```bash BAIDU_API_KEY="你的APIKey" python3 skills/baidu-search/scripts/search.py '{"query":"股票名 2024年 财报 净利润 经营现金流", "search_recency_filter":"year"}' ``` ``` `README.md:68-75`: ```markdown ### 0) 前提：搜索 Key 的放置（稳定，不依赖 shell / launchd） 推荐把百度 AI Search 的 key 放到固定文件路径： - `~/.openclaw/env/BAIDU_API_KEY` - 文件内容可以是纯 key（单行），也可以是 `BAIDU_API_KEY=...` 的 .env 风格。 这样无论是后台 gateway / cron / skill 运行，都不会因为“终端能 echo、服务拿不到”而翻车。 ``` ### Technical Analysis The initialization prompt encourages users to place an API key directly in an interactive shell command. Such commands may be retained in shell history, terminal logs, session recordings, support transcripts, or automation logs. Depending on the operating system and process-inspection permissions, environment variables may also be visible to other processes running under the same account or to privileged local processes. The README recommends storing the key as plaintext at a predictable filesystem path but does not require restrictive ownership and permissions. If the file is created under an unsafe `umask`, inherited from another user, included in backups, or accessible to another local process, the credential may be disclosed. The recommendation that gateways, cron jobs, and Skills all use this file broadens the number of components that may access it. The project does not contain code that directly exfiltrates this credential, and exploitation requires local access, exposed logs, or another compromised process. Nevertheless, the documented procedure creates avoidable credential-exposure risks. ### Attack Path 1. A user follows `prompts/init.md` and substitutes a real Baidu API key into the inline shell command, or follows `README. ...[truncated 1052 chars]
- Remediation
- ## Remediation Suggestions 1. Remove real-secret placeholders from inline command examples. Instruct users to configure credentials through the dependency's supported secure credential mechanism before running the command. 2. Prefer an operating-system secret store or managed secret facility over a plaintext file. 3. If file-based storage is unavoidable: - Create the directory and file with restrictive permissions, such as directory mode `0700` and file mode `0600`. - Verify that the file is owned by the expected account before reading it. - Reject files that are symbolic links or are writable/readable by unintended users. - Use an atomic file-creation procedure under a restrictive `umask`. 4. Do not print credentials in commands, logs, exceptions, debugging output, process titles, or generated reports. 5. Limit credential access to the specific process that requires it instead of making it broadly available to gateways, cron jobs, and unrelated Skills. 6. Document credential rotation and revocation procedures in case the key was previously entered into shell history or stored with unsafe permissions. 7. Advise affected users to remove historical commands securely where practical, inspect automation logs, rotate exposed keys, and review API usage for unauthorized activity.