T09 · Insecure Skill Coding Practices
Error
- Location
- references/setup-provider-openclaw.md:63
- Finding
- Credential Files Are Printed into Agent and Terminal Output<![CDATA[ ## Vulnerability Details **File Locations**: - `references/setup-provider-openclaw.md:63-67` - `references/setup-employer.md:22-26` **Vulnerability Type**: Sensitive credential disclosure **Risk Level**: High ### Vulnerable Code `references/setup-provider-openclaw.md:63-67`: ```bash Check for existing credentials: ```bash cat ~/.corall/credentials/provider.json 2>/dev/null || echo "No credentials found" ``` ``` `references/setup-employer.md:22-26`: ```bash Check for existing credentials: ```bash cat ~/.corall/credentials/employer.json 2>/dev/null || echo "No credentials found" ``` ``` ### Technical Analysis The setup workflows only need to determine whether the relevant profile is authenticated. Instead, they instruct the Agent to read and print the complete profile credential document. This exposes every value in the files to: - The Agent's active context. - Terminal output and scrollback. - Session transcripts and execution logs. - Screen recording and monitoring systems. - Any user or process able to observe the command output. This behavior also conflicts with the guides' later instruction to never display or log credential values. Reading and printing the complete files exceeds the minimum access necessary for setup because the purpose-built commands `corall auth me --profile provider` and `corall auth me --profile employer` can test authentication without directly exposing stored credentials. The exact contents of these JSON files are not documented in the audited project, so the presence of any particular token field cannot be asserted. Nevertheless, files explicitly designated as credentials must be handled as sensitive in their entirety. ### Attack Path 1. A user asks the Agent to configure a provider or employer profile. 2. The Agent follows the corresponding setup guide. 3. The Agent executes `cat` against the profile's credential file. 4. The complete credential document enters terminal output and potentially the Agent trans ...[truncated 903 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove both `cat ~/.corall/credentials/...` instructions. 2. Use the CLI's scoped authentication checks instead: ```bash corall auth me --profile provider corall auth me --profile employer ``` 3. If setup must distinguish a missing file from an invalid login, test only for existence without reading its contents: ```bash if test -f "$HOME/.corall/credentials/provider.json"; then echo "Provider credential file exists" else echo "No provider credential file found" fi ``` 4. Do not print, parse, summarize, or return credential-file contents to the Agent. 5. Have the CLI enforce restrictive credential-file permissions, such as owner-only read/write access. 6. Add regression tests that fail if setup documentation instructs an Agent to print files under credential or secret directories. ]]>