T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/clawctl.mjs:3238
- Finding
- Sensitive Files Inside Installed Skills Are Exported Without Filtering<![CDATA[ ## Vulnerability Details **File Location**: `scripts/clawctl.mjs:3238-3265` **Vulnerability Type**: Unfiltered sensitive-file export **Risk Level**: High ### Vulnerable Code ```js async function collectAllFiles2(dir, baseDir) { const files = []; let entries; try { entries = await readdir2(dir, { withFileTypes: true }); } catch { return files; } for (const entry of entries) { const fullPath = join3(dir, entry.name); const relPath = relative2(baseDir, fullPath); if (entry.isDirectory()) { files.push(...await collectAllFiles2(fullPath, baseDir)); } else if (entry.isFile()) { const content = await readFile3(fullPath); files.push({ relativePath: relPath, absolutePath: fullPath, content, size: content.length }); } } return files; } async function scanSkills(stateDir) { const skillsDir = join3(stateDir, "skills"); // ... for (const entry of entries) { if (!entry.isDirectory()) continue; const skillDir = join3(skillsDir, entry.name); const files = await collectAllFiles2(skillDir, skillDir); // ... skills.push({ name: entry.name, version, source, files }); } return skills; } ``` ### Technical Analysis The workspace scanner applies mandatory filename exclusions, but `scanSkills()` invokes a separate unrestricted recursive collector. Every regular file under each directory in `~/.openclaw/skills/` is read and subsequently included in the exported package. The skill collector does not apply `MANDATORY_FILE_EXCLUSIONS`, user-defined `.clawignore` rules, secret-pattern detection, or content redaction. Files such as `.env`, credential stores, private keys, certificates, session artifacts, and skill-specific configuration files can therefore be bundled without warning. This directly conflicts with the documentation’s broad assertion that API keys, tokens, and passwords are automatically stripped and that the resulting package is sa ...[truncated 1031 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Apply the same mandatory and user-defined exclusion rules to skill files as to workspace files. 2. Explicitly reject common secret-bearing files, including `.env`, credentials, authentication profiles, session stores, private keys, certificates, and password databases. 3. Run content-based secret detection over every textual skill file before packaging. 4. Redact detected values or fail the export and require explicit user review. 5. Reject symbolic links and non-regular files during recursive collection. 6. Report which files were excluded and distinguish configuration sanitization from full-package secret scanning. 7. Add tests proving that nested `.env`, `.pem`, credential JSON, and token-bearing text files are not exported. ]]>