T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:18- Finding
Plaintext Credential Storage and Insecure HTTP Transmission
- Content
View full analysis
"$HOME/.openclaw/skills/sun-panel/config.json" << 'EOF' { "url": "USER_PROVIDED_URL", "username": "USER_PROVIDED_USERNAME", "password": "USER_PROVIDED_PASSWORD" } EOF echo "配置已保存到 $HOME/.openclaw/skills/sun-panel/config.json" ``` Credential transmission at lines 79-82: ```bash RESPONSE=$(curl -s -X POST "$SUN_PANEL_URL/api/login" \ -H "Content-Type: application/json" \ -d "{\"username\":\"$SUN_PANEL_USERNAME\",\"password\":\"$SUN_PANEL_PASSWORD\"}") ``` ### Technical Analysis The configuration procedure persists a reusable password directly in `config.json`. No `umask`, `chmod`, ownership validation, or other access-control operation is applied. Consequently, the effective permissions depend on the host's existing umask and directory permissions. On a shared or compromised system, another local account or process may be able to read the credential file. The example service URL uses `http://`, and the skill does not validate that `SUN_PANEL_URL` uses HTTPS. If HTTP is used over an untrusted network, the username and password in the login request are transmitted without transport encryption. The token returned by the server and subsequent authenticated API calls are similarly exposed t ...[truncated 2289 chars]- Remediation
View remediation
&2 exit 1 fi cat > "$CONFIG_FILE" << 'EOF' { "url": "USER_PROVIDED_HTTPS_URL", "username": "USER_PROVIDED_USERNAME", "password": "USER_PROVIDED_PASSWORD" } EOF chmod 600 "$CONFIG_FILE" ``` 4. **Validate configuration before authentication** - Parse and validate the URL scheme and hostname. - Refuse empty, malformed, or unexpected values. - Warn users when connecting to private or self-hosted endpoints whose identity cannot be verified. 5. **Limit token exposure** - Keep authentication tokens only in process memory. - Never print token values. - Reauthenticate when necessary rather than persisting tokens. ...[truncated 80 chars]