T09 · Insecure Skill Coding Practices
Warning
- Location
- references/apikey-fetch.md:18
- Finding
- Plaintext API Key Storage in OpenClaw Configuration<![CDATA[ ## Vulnerability Details **File Location**: `references/apikey-fetch.md`, lines 18-22 **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium ### Vulnerable Code Snippet ```json { "skills": { "entries": { "baidu-search": { "env": { "BAIDU_API_KEY": "your_actual_api_key_here" ``` ### Technical Analysis The setup guide instructs users to store the Baidu API key directly in `~/.openclaw/openclaw.json` as plaintext. No guidance is provided to restrict file permissions, use a dedicated secret manager, or otherwise protect the credential at rest. Although the API key is legitimately required by the Skill, persisting it in an inadequately protected configuration file may expose it to other local users, processes, backup systems, diagnostic tools, or accidental repository commits. The runtime network behavior itself is consistent with the declared functionality: `scripts/search.py` reads `BAIDU_API_KEY` from the environment and sends it as a Bearer credential only to the declared Baidu HTTPS API endpoint. ### Attack Path 1. A user follows the setup guide and places a valid Baidu API key in `~/.openclaw/openclaw.json`. 2. The configuration file is created with permissions that allow another local account or process to read it, or it is copied into an insecure backup or support bundle. 3. The attacker reads the plaintext `BAIDU_API_KEY` value. 4. The attacker submits authenticated requests to the Baidu API while impersonating the victim. 5. The stolen credential remains usable until it expires or is revoked. This path requires access to the configuration file or an exposed copy of it; the audited Skill does not itself transmit the key to an undeclared endpoint. ### Impact Assessment An attacker who obtains the key can consume the victim's Baidu API quota, incur service charges where applicable, access capabilities authorized to that API credential, and cause service disruption through quota ...[truncated 164 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Prefer injecting `BAIDU_API_KEY` at runtime from an operating-system credential store, deployment secret manager, or OpenClaw-supported protected secret facility. 2. If configuration-file storage is unavoidable, explicitly require owner-only permissions: ```bash chmod 600 ~/.openclaw/openclaw.json ``` 3. Warn users not to commit, upload, print, or include the configuration file in logs, backups, or support bundles without redaction. 4. Use a dedicated, least-privileged API credential for this Skill and apply provider-side quota and usage restrictions where available. 5. Document procedures for immediate credential revocation and rotation after suspected exposure. 6. Avoid commands that display the complete configuration when validating it, because validation output may expose the key in terminals or captured logs. Use a validation method that does not print secret values. ]]>