T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
- SKILL.md:14
- Finding
- Documentation-Only Skill Requests Unnecessary Sensitive Credentials## Vulnerability Details **File Location**: `SKILL.md:14-22` **Vulnerability Type**: Violation of least privilege through excessive credential requirements **Risk Level**: Medium ### Vulnerable Code ```yaml credentials: [GITHUB_TOKEN, WALLET_ADDRESS, DASHBOARD_SECRET] metadata: openclaw: requires: env: - GITHUB_TOKEN - WALLET_ADDRESS - DASHBOARD_SECRET primaryEnv: GITHUB_TOKEN ``` ### Technical Analysis The Skill declares itself to be a non-executable educational guide with `executable: false` and `install: none`. Its notice also states that the documented sandbox requires no API key. Despite this, the metadata requires the host to provide a GitHub personal access token and an administrative dashboard secret when the Skill is loaded. These credentials are not necessary to read or use the guide. Requiring them therefore violates least privilege by expanding the Skill's credential exposure beyond its declared runtime needs. Designating `GITHUB_TOKEN` as `primaryEnv` further increases the likelihood that a sensitive repository token will be provisioned by default. The guide later describes legitimate, optional deployment-time uses for these values: fetching paid content from a private GitHub repository and authenticating to a storefront's administrative API. Those optional operations do not justify requiring the credentials for the documentation-only Skill itself. No executable source or script is present in the audited package, so the audit found no evidence that the current artifact actively reads or exfiltrates these credentials. The finding concerns unnecessary credential provisioning and the resulting access surface, rather than confirmed credential theft. ### Attack Path 1. A user installs or loads the Skill to consult its educational content. 2. The host processes the `metadata.openclaw.requires.env` declaration. 3. The host or user supplies `GITHUB_TOKEN` and `D ...[truncated 1519 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `GITHUB_TOKEN` and `DASHBOARD_SECRET` from `credentials`, `metadata.openclaw.requires.env`, and `primaryEnv`. 2. Do not require any secret merely to install or read this non-executable guide. 3. Request credentials only when a user explicitly performs an optional deployment or private-content-delivery operation. 4. For GitHub access, recommend a fine-grained, read-only token restricted to the single content repository and only the required content permissions. 5. Keep the dashboard secret in the deployed server's secret manager or protected environment, not in the Skill-loading environment. 6. Prevent secrets from appearing in command history, logs, generated configuration, or client-side output. 7. Align the metadata name `WALLET_ADDRESS` with the documented configuration name `AGENT_WALLET_ADDRESS` to avoid users provisioning unintended variables. 8. Clearly separate “guide requirements” from “optional deployment requirements” in both metadata and documentation. 9. If future versions add executable files, ensure those files receive only operation-specific credentials at invocation time and add automated checks for unexpected environment-variable access or outbound transmission.