令牌管理中心

• Outcome: Review
• Latest audit: May 28, 2026 · 10:10 AM UTC
• Version: 2.1.1

Overview

This is a real local credential manager, but it handles highly sensitive secrets and contains ambiguous or overstated safety behavior that users should review before installing.

Install only if you are comfortable storing API keys, passwords, and similar secrets in ~/.openclaw/workspace/secrets.json and revealing them through local command output. Treat autocapture as opt-in only, avoid bulk raw listing in logged terminals or CI, and do not rely on the secure-delete wording for forensic erasure.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• MCP Least Privilege: Underdeclared Capability, Wildcard Permission, Missing Permission Declaration
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 92% confidence
• Finding: The skill clearly describes capabilities to read and write local secret stores and invoke Python scripts, but it declares no permissions. This creates a transparency and governance gap: users and the platform cannot accurately assess or constrain access to sensitive files and shell execution before installation or use.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 90% confidence
• Finding: The advertised purpose is credential management, but the documented behavior expands into scanning arbitrary user-provided text for secrets, inferring context, and saving detected credentials, plus migrating prior stores. That broader behavior materially increases the chance of collecting and persisting secrets from conversations or unrelated content without sufficiently explicit, informed consent.

Intent-Code Divergence

Medium

• Confidence: 95% confidence
• Finding: The autocapture section contains contradictory statements: one line says credentials detected in conversation are automatically parsed and saved, while the privacy note says detection only previews and requires confirmation before writing. For a secrets-management skill, this ambiguity is dangerous because users cannot reliably know whether sensitive credentials will be persisted automatically.

Description-Behavior Mismatch

Medium

• Confidence: 96% confidence
• Finding: The `--raw` path prints secret field values in full to stdout, directly exposing stored credentials, API tokens, passwords, or keys to anyone with terminal access, shell history capture, screen logging, or redirected output. In a token-management skill whose purpose is to store highly sensitive material, a bulk raw listing function materially increases the chance of mass secret disclosure.

Intent-Code Divergence

Medium

• Confidence: 98% confidence
• Finding: The code and comments claim that secret values are overwritten 'in place' and securely destroyed, but Python strings are immutable and assigning '\x00' * len(value) only creates a new string object and replaces a reference in the JSON structure. The original secret may remain in process memory, Python allocator arenas, swap, prior file contents, backups, journals, or recovery artifacts, so users may rely on a security property that is not actually provided.

Intent-Code Divergence

Medium

• Confidence: 97% confidence
• Finding: The function advertises '安全删除' semantics, but rewriting a JSON file and deleting an entry does not guarantee secure file erasure on modern filesystems. Data may persist in previous file blocks, copy-on-write snapshots, editor or backup copies, filesystem journals, cloud sync history, or disk wear-leveling layers, creating a mismatch between promised and actual protection for highly sensitive credentials.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The script can persist a newly generated password to disk via `--save` without any confirmation, warning, or encryption step. In a credential-management skill, silently writing plaintext secrets to `~/.openclaw/workspace/secrets.json` increases exposure through local compromise, backups, sync tools, or accidental disclosure, especially because the same script also prints the password to stdout.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The getter mutates and rewrites the secrets database on every read by updating read_count and last_read, even though the operation appears to be read-only. This creates unnecessary integrity risk for highly sensitive data: a simple read can corrupt or lose the secrets file if interrupted, raced, or performed when permissions/storage are abnormal, and users are not warned that retrieval changes persistent state.

Missing User Warnings

Medium

• Confidence: 99% confidence
• Finding: When a field is requested, the code prints the raw secret to stdout, and when no field is specified it prints every field value in the entry, exposing credentials directly to terminal history, logs, calling processes, screen capture, and upstream tooling. In a token-management skill, this is especially dangerous because the entire purpose of the component is to handle API tokens, passwords, and SSH keys, so disclosure of stdout effectively becomes credential exfiltration.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: Raw secret values are emitted without any warning, re-authentication, or confirmation step, making accidental disclosure easy during normal administrative use. This is especially risky because command output may be logged by terminals, CI systems, remote session tools, or copied into tickets and chat unintentionally.

Missing User Warnings

Medium

• Confidence: 79% confidence
• Finding: The migration overwrites a secrets file in place without first creating a backup, using an atomic replace flow, or requiring confirmation. In a secret-management skill, modifying credential storage unsafely is more dangerous because corruption, partial writes, or unintended format conversion can destroy or expose critical credentials and disrupt dependent systems.

Credential Access

High

• Category: Privilege Escalation

Content

### autocapture.py — 自动截获（AI 对话中自动调用）

当 AI 在对话中检测到凭证信息时，自动解析并保存到 `secrets.json`。

**自动识别的凭证类型：**
| 类型 | 匹配模式 | 自动分类 |

• Confidence: 97% confidence
• Finding: This skill is explicitly designed to collect, store, and later retrieve highly sensitive credentials in a local secrets file, and the autocapture feature increases the likelihood of ingesting secrets from conversational text. In the context of an agent skill, credential harvesting and persistence are inherently high-risk because any implementation flaw, overbroad access, or misuse could expose API keys, passwords, or cloud credentials.

Credential Access

High

• Category: Privilege Escalation

Content

- **安全删除**：文件删除前覆写3次随机数据
- **审计日志**：所有操作记录到 `secrets.audit.log`，仅追加不可修改
- **输入消毒**：所有 key 只允许 `[a-zA-Z0-9_\-]`，长度≤64，防止 injection
- 不要将 `secrets.json` 提交到 Git

## 文件结构

• Confidence: 90% confidence
• Finding: Referencing a persistent secrets.json store confirms that the skill maintains a concentrated local repository of credentials. Even with documented protections, a single file containing API tokens, passwords, and keys is a high-value target, and the risk is amplified because the skill also supports reading, backup, migration, and audit logging around those secrets.

Static analysis

No suspicious patterns detected.