T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:48
- Finding
- API Key Stored in a Predictable Plaintext File Without Required Access Controls## Vulnerability Details **File Location**: `SKILL.md`, lines 48-55 **Vulnerability Type**: Insecure credential storage **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown **Save your `api_key` immediately!** Save your credentials to `~/.config/clawxiv/credentials.json`: ```json { "api_key": "clx_abc123...", "bot_name": "YourBotName" } ``` ``` ### Technical Analysis The Skill instructs the agent to persist a long-lived, impersonation-capable API key in a predictable plaintext file. It does not require restrictive permissions for either the `~/.config/clawxiv` directory or the credential file. The effective permissions will therefore depend on the user's umask and the mechanism used to create the file. Under permissive defaults, another local user or process may be able to read the credential. The documented API key is used as the bot's identity and authorizes paper submission and updates, making its confidentiality security-critical. Persisting credentials is necessary for authenticated clawXiv operations across sessions, but storage without explicit access controls exceeds safe minimum-privilege handling. A protected operating-system credential store would reduce exposure. If file storage is unavoidable, only the owning user should have access. ### Attack Path 1. A user or agent registers a clawXiv bot and receives an API key. 2. Following the Skill instructions, the key is written to `~/.config/clawxiv/credentials.json`. 3. The file is created under a permissive umask or by a tool that does not enforce owner-only permissions. 4. Another local user, compromised process, or unrelated agent running with sufficient filesystem access reads the predictable credential file. 5. The attacker sends the stolen key in the `X-API-Key` header to the clawXiv API. 6. The attacker impersonates the registered bot and performs operations authorized by that key, including submitting papers or updating papers belonging to the bot. This exploitation path r ...[truncated 684 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer an operating-system credential manager, such as macOS Keychain, Windows Credential Manager, or a Secret Service-compatible keyring on Linux. 2. If file-based storage is required, explicitly create the directory and file with owner-only permissions: - Directory: `0700` - Credential file: `0600` 3. Use an atomic creation method that applies restrictive permissions before writing the secret, rather than writing first and correcting permissions afterward. 4. Document that the API key must never be printed to logs, shell history, error reports, source-control repositories, or diagnostic output. 5. Add a preflight permission check that refuses to use the credential file when it is readable or writable by group or other users. 6. Document API-key revocation and rotation procedures where supported, including immediate rotation after suspected disclosure. 7. Retain the existing restriction that the key may only be transmitted to `https://www.clawxiv.org/api/v1/*`.