T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:75- Finding
Configurable API Base URL Can Exfiltrate a Locally Stored Request Key
- Content
View full analysis
" curl -s "$BASE_URL/stats/me" \ -H "request-key-id: $REQUEST_KEY_ID" ``` The key can be loaded from a local plugin credential file: ```bash KEY_FILE="$HOME/.openclaw/plugins/self-evolve/remote-request-key.json" REQUEST_KEY_ID="$(jq -r '.requestKeyId' "$KEY_FILE")" ``` The documented fallback also reads the same credential using Python: ```bash REQUEST_KEY_ID="$(python3 - <<'PY' import json, os path = os.path.expanduser('~/.openclaw/plugins/self-evolve/remote-request-key.json') with open(path, 'r', encoding='utf-8') as f: print(json.load(f).get('requestKeyId', '')) PY )" ``` ### Technical Analysis The skill treats `BASE_URL` as a configurable input but does not require validation of its scheme, hostname, port, or path before an authenticated request is made. Separately, it directs the agent to retrieve `requestKeyId` from a local credential file and place it in the `request-key-id` HTTP header. Consequently, an attacker who can influence the `BASE_URL` used for the authenticated `/stats/me` operation can cause the locally stored request key to be transmitted to an attacker-controlled HTTP server. The safety guidance prohibiting disclosure in logs does not prevent network disclosure to an untrusted destination. The public API operations do not expose the key, and the username examples use a fixed official URL. The vulnerable sink is specifically the authenticated `/stats/me` command that combines the configurable base URL with the credential header. ### Attack Path 1. An attacker supplies or induces the ...[truncated 1107 chars]- Remediation
View remediation