T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:39
- Finding
- Identity-Bearing MCP Token Exposed Through Command-Line Arguments and Plaintext Configuration<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39–58 **Vulnerability Type**: Sensitive credential exposure through insecure secret handling **Risk Level**: Medium ### Vulnerable Code Snippet ```bash openclaw mcp set mcd-mcp \ --transport streamable-http \ --url https://mcp.mcd.cn \ --header "Authorization" "Bearer YOUR_MCP_TOKEN" ``` ```json { "mcp": { "servers": { "mcd-mcp": { "url": "https://mcp.mcd.cn", "transport": "streamable-http", "headers": { "Authorization": "Bearer YOUR_MCP_TOKEN" } } } } } ``` ### Technical Analysis The Skill instructs the user to substitute an identity-bearing MCP token directly into a shell command or store it as a plaintext bearer credential in `~/.openclaw/openclaw.json`. Passing the token as a command-line argument may expose it through shell history, terminal capture, agent execution logs, telemetry, debugging output, or process inspection while the command is running. The fallback configuration persists the bearer token in plaintext without requiring restrictive file permissions, encryption, a credential manager, or log redaction. The document separately identifies this token as representing the user's McDonald's membership identity. Consequently, it should be treated as a sensitive authentication secret rather than ordinary configuration data. Although the reviewed file does not transmit the token to an unrelated endpoint, the prescribed handling unnecessarily increases the probability of credential disclosure. ### Attack Path 1. A user obtains a valid MCP token associated with their McDonald's membership account. 2. Following the Skill instructions, the user or agent inserts the token into the `openclaw mcp set` command or the OpenClaw JSON configuration. 3. The token is retained in shell history, an agent transcript, execution logs, terminal recordings, or a plaintext configuration file. 4. An attacker with access to th ...[truncated 1016 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste MCP tokens into the conversation or expose them to an agent transcript. 2. Use a non-echoing local credential prompt so the secret is entered directly by the user. 3. Store the token in an operating-system credential manager, encrypted secret store, or OpenClaw-supported secret provider instead of embedding it in JSON. 4. Reference the credential indirectly through a secret identifier or protected environment variable where supported. 5. Avoid placing the token in command-line arguments. If a command must consume it, provide it through protected standard input or a secure credential API. 6. If a configuration file is unavoidable, restrict it to the owning user, such as mode `0600` on Unix-like systems, and ensure parent directories are not broadly accessible. 7. Redact `Authorization` headers and bearer tokens from command output, application logs, telemetry, crash reports, and debugging traces. 8. Document how users can revoke and rotate a token after suspected disclosure. 9. Minimize token permissions and lifetime if the MCP service supports scoped or short-lived credentials. 10. Add explicit warnings that saved addresses, points, coupons, and transactional operations may be accessible to anyone who obtains the token. ]]>