T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:14
- Finding
- Unnecessary Exposure of Sensitive Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 14–20 **Vulnerability Type**: Excessive credential access violating least privilege **Risk Level**: Medium ```yaml credentials: [AGENT_SIGNING_KEY, GREENHELIX_API_KEY] metadata: openclaw: requires: env: - AGENT_SIGNING_KEY - GREENHELIX_API_KEY primaryEnv: AGENT_SIGNING_KEY ``` ### Technical Analysis The skill declares `AGENT_SIGNING_KEY` and `GREENHELIX_API_KEY` as required credentials and identifies the signing key as its primary environment credential. However, the package contains only a descriptive Markdown file, is marked `executable: false`, requires no installation, and includes no implementation that uses either secret. Requiring sensitive credentials without demonstrated functional need violates the principle of least privilege. If the hosting platform resolves these declarations by making the named environment variables available to the loaded skill or a related execution context, sensitive signing and API credentials could be exposed unnecessarily. No executable code, transmission endpoint, or credential-exfiltration mechanism is present in the audited package. Therefore, this finding establishes unnecessary credential access rather than confirmed theft or exfiltration. ### Attack Path 1. A user installs or loads the skill in a compatible host. 2. The host processes the credential requirements declared in `SKILL.md`. 3. The user or host supplies `AGENT_SIGNING_KEY` and `GREENHELIX_API_KEY`. 4. The credentials become available to the skill context despite the package having no documented or implemented need for them. 5. If untrusted functionality is later added to the package or the credential-bearing context is otherwise compromised, the unnecessarily exposed secrets could be accessed and abused. This path depends on the host supplying declared credentials to the skill context. The current package itself ...[truncated 638 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `credentials` declaration because the current package is non-executable and does not use credentials. 2. Remove `metadata.openclaw.requires.env` and `metadata.openclaw.primaryEnv`. 3. If future executable functionality genuinely requires authentication, request only the minimum necessary credential at the point of use. 4. Avoid designating a private signing key as a general-purpose primary environment credential. 5. Document each credential's exact purpose, required permission scope, recipient service, and lifecycle. 6. Use narrowly scoped, revocable credentials rather than long-lived or broadly privileged keys. 7. Ensure the host does not expose secrets to documentation-only or non-executable skills. 8. Add automated manifest validation that rejects unused credential declarations.