T09 · Insecure Skill Coding Practices
Warning
- Location
src/cli.js:143- Finding
API Key Exposed Through Command-Line Arguments and Plaintext Configuration Storage
- Content
View full analysis
{ const { apiKey: _legacyApiKey, endpointHint: _legacyEndpointHint, ...openclawBase } = rawConfig; return { ...openclawBase, skills: { ...rawConfig.skills, entries: { ...rawConfig?.skills?.entries, [SKILL_NAME]: { ...skillConfig, enabled: true, apiKey, }, }, }, }; })() : { ...rawConfig, apiKey, endpointHint: 'logged-in', }; const config = await writeConfig(nextConfig, targetPath); return config; } ``` ```js async function loginCommand(options, jsonMode) { const apiKey = options['api-key']; if (!apiKey) { throw new Error('Please provide api key: signal-track login --api-key '); } // use API-key header to verify key validity const result = getOutputPayload(await apiPost('/api/younews/subscription/identity/login', {}, { apiKey })); if (!result || result.code !== 200) { const msg = (result && (result.displayMessage || result.message)) || 'Login failed'; throw new Error(msg); } await persistLoginConfig(apiKey); ``` ### Technical Analysis The login inter ...[truncated 2191 chars]- Remediation
View remediation
` with a masked interactive prompt or a standard-input mechanism that does not place the secret in the process argument list. 2. If command-line input must remain supported for automation, clearly warn users about shell-history and process-list exposure and prefer a protected file descriptor or secret-manager integration. 3. Store the API key in the operating system's credential store rather than in a JSON configuration file. 4. Where file-based storage is unavoidable, create the configuration directory with mode `0700` and the credential file with mode `0600`. 5. Validate and, where safe, repair permissions on existing credential files before reading or updating them. 6. Consider separating non-sensitive OpenClaw configuration from authentication secrets so the general configuration file does not need to contain bearer credentials. 7. Provide logout and key-rotation commands that securely remove stored credentials and explain that previously exposed keys should be revoked server-side. 8. Continue restricting authenticated requests to the declared HTTPS origin and ensure redirects cannot forward the `Authorization` header to an untrusted host. ]]>