T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:13
- Finding
- Unjustified Declaration of Broad Sensitive Credentials## Vulnerability Details **File Location**: `SKILL.md`, lines 13–23 **Vulnerability Type**: Excessive credential access and violation of least privilege **Risk Level**: Medium ### Vulnerable Code ```yaml credentials: [GITHUB_TOKEN, WALLET_ADDRESS, DASHBOARD_SECRET, GREENHELIX_API_KEY, AGENT_SIGNING_KEY, STRIPE_API_KEY] metadata: openclaw: requires: env: - GITHUB_TOKEN - WALLET_ADDRESS - DASHBOARD_SECRET - GREENHELIX_API_KEY - AGENT_SIGNING_KEY - STRIPE_API_KEY primaryEnv: GITHUB_TOKEN ``` ### Technical Analysis The manifest declares six sensitive environment values as requirements, including repository access, payment-provider access, dashboard authentication, API access, and an agent signing key. The artifact is marked as non-executable and contains no implementation or documented workflow that uses these credentials. Consequently, the declarations are not justified by any functionality present in the reviewed package and violate the principle of least privilege. If the host platform injects declared environment variables into a skill context, loading this package could unnecessarily place several high-value credentials within that context. The reviewed file contains no command, script, or transmission mechanism, so direct credential theft or exfiltration is not demonstrated. The risk is unnecessary credential exposure and an enlarged trust boundary rather than a confirmed leak. ### Attack Path 1. A user installs or loads the skill based on its storefront and payment functionality claims. 2. The host interprets the `credentials` and `metadata.openclaw.requires.env` declarations. 3. The host requests or injects the listed secrets into the skill context. 4. Repository, dashboard, payment, API, and signing credentials become unnecessarily available to the package context. 5. If omitted, subsequently added, or otherwise unreviewed package con ...[truncated 1041 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all credential declarations from the current metadata-only, non-executable package. 2. Add a credential only when audited implementation code has a concrete and documented need for it. 3. Separate optional integrations so users do not need to provide unrelated repository, payment, dashboard, API, and signing credentials together. 4. Use narrowly scoped, short-lived tokens instead of broad or long-lived secrets. 5. Avoid supplying signing keys directly through a general skill environment; use an isolated signer or key-management service with explicit operation policies. 6. Restrict GitHub and Stripe credentials to the minimum repositories, resources, and API operations required. 7. Document the purpose, required scope, lifetime, storage behavior, and revocation procedure for every requested credential. 8. Add the advertised implementation and guides to the package, then perform a separate audit before enabling any credential-dependent functionality.