T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:13
- Finding
- Unnecessary Declaration of High-Value Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 13–20 **Vulnerability Type**: Excessive credential access violating least privilege **Risk Level**: Medium ### Vulnerable Code ```yaml credentials: [STRIPE_API_KEY, GREENHELIX_API_KEY, AGENT_SIGNING_KEY, WALLET_ADDRESS] metadata: openclaw: requires: env: - STRIPE_API_KEY - GREENHELIX_API_KEY - AGENT_SIGNING_KEY - WALLET_ADDRESS primaryEnv: STRIPE_API_KEY ``` ### Technical Analysis The manifest declares access to a Stripe API key, a GreenHelix API key, an agent signing key, and a wallet address. However, the audited package contains only a 34-line documentation manifest and is explicitly marked `executable: false`. It contains no scripts, templates, network operations, or other implementation that requires these credentials. Requiring payment and signing credentials without a demonstrated functional need violates the principle of least privilege. `STRIPE_API_KEY` and `AGENT_SIGNING_KEY` are particularly sensitive because their effective privileges may include payment-platform operations and cryptographic authorization, depending on how the credentials are configured. The current package contains no code that reads, transmits, or misuses these values, so active credential theft or exfiltration is not established. The risk arises from unnecessarily making high-value secrets available to the Skill context, increasing the consequences of future package changes, prompt injection, or a compromised execution component. ### Attack Path 1. A user installs or loads the Skill based on its manifest. 2. The host attempts to satisfy the declared environment requirements. 3. The host exposes the listed payment, API, and signing credentials to the Skill context or associated runtime. 4. A later malicious package update, injected instruction, or compromised runtime component accesses those unnecessarily exposed val ...[truncated 1010 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all entries from `credentials` and `metadata.openclaw.requires.env` because the current documentation-only package does not use them. 2. Remove `primaryEnv: STRIPE_API_KEY` unless executable functionality with a documented Stripe integration is added. 3. If future functionality legitimately requires authentication, request only the specific credential needed by that operation. 4. Use narrowly scoped, short-lived tokens instead of unrestricted or long-lived API keys. 5. Do not expose private signing keys directly to a general Skill runtime. Use a dedicated signing service, hardware-backed keystore, or approval-gated signing interface. 6. Separate optional integrations so credentials are requested only when the corresponding feature is invoked. 7. Document each credential's purpose, required scope, storage expectations, and rotation procedure. 8. Add validation to release review processes to reject non-executable or documentation-only Skills that declare unnecessary secrets.