T09 · Insecure Skill Coding Practices
- Location
quick.sh:138- Finding
MiniMax credentials stored persistently in plaintext
- Content
View full analysis
Vulnerability Details
File Location:
quick.sh:19-25, 135-140
Vulnerability Type: Plaintext credential storage
Risk Level: HighVulnerable Code
bash MEMORY_FILE="/home/allen/.openclaw/workspace/memory/minimax-login.txt" PHONE="" PASSWORD="" if [ -f "$MEMORY_FILE" ]; then PHONE=$(grep "phone=" "$MEMORY_FILE" | cut -d'=' -f2) PASSWORD=$(grep "password=" "$MEMORY_FILE" | cut -d'=' -f2-) fibash # If a password is available, save it to memory if [ -n "$PASSWORD" ]; then echo "💾 Saving credentials to memory..." echo "phone=$PHONE" > "$MEMORY_FILE" echo "password=$PASSWORD" >> "$MEMORY_FILE" chmod 600 "$MEMORY_FILE" fiTechnical Analysis
The script writes the user's MiniMax phone number and account password directly to a persistent text file. Although the file is subsequently assigned mode
600, its contents remain unencrypted and accessible to every process operating under the same local user account. The file may also be exposed through backups, Agent workspace collection, debugging tools, or another skill with filesystem access.Applying permissions only after writing also creates a potential exposure window. The initial redirection creates the file according to the process umask before
chmod 600is executed. If the script terminates between these operations or the umask permits broader access, the credential file may retain unsafe permissions.The file is located in an Agent memory directory even though it contains authentication material rather than non-sensitive state. This increases the chance that credentials will be included in memory processing, workspace synchronization, or diagnostic collection.
Attack Path
- A user runs
quick.shwith password-based MiniMax authentication. - The script writes the phone number and password to
/home/allen/.openclaw/workspace/memory/minimax-login.txt. - An attacker obtains same-use ...[truncated 685 chars]
- A user runs
- Remediation
View remediation
Remediation Suggestions
- Remove all logic that stores passwords in
minimax-login.txtor any other plaintext workspace or memory file. - Prefer the authenticated browser session already maintained by the dedicated browser profile.
- If persistent authentication material is unavoidable, store it in an operating-system credential manager or secret service and retrieve it only when needed.
- Prefer short-lived, revocable, narrowly scoped session tokens over reusable account passwords where the service supports them.
- Use interactive password entry with hidden terminal input, such as
read -s, rather than persisting the password. - Delete existing plaintext credential files and advise affected users to rotate any password previously stored there.
- Keep authentication material outside Agent memory, logs, backups, and synchronized workspace directories.
- For any remaining sensitive file creation, set
umask 077before creation and create the file atomically with restrictive permissions rather than correcting permissions afterward.
- Remove all logic that stores passwords in