T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:35
- Finding
- Potentially Sensitive Prompts Stored in Plaintext Without Explicit Access Controls## Vulnerability Details **File Location**: `SKILL.md:35-59`, `SKILL.md:65-69`, and `SKILL.md:972-975` **Vulnerability Type**: Insecure storage of potentially sensitive user data **Risk Level**: Medium ### Vulnerable Code ```markdown On first message, create data directory: ```bash mkdir -p ~/.openclaw/prompt-optimizer ``` Initialize files: ```json // ~/.openclaw/prompt-optimizer/settings.json { "default_model": "any", "prompts_optimized": 0, "templates_used": 0, "prompts_saved": 0, "streak_days": 0 } ``` ```json // ~/.openclaw/prompt-optimizer/library.json [] ``` ```json // ~/.openclaw/prompt-optimizer/history.json [] ``` ``` ```markdown All data stored under `~/.openclaw/prompt-optimizer/`: - `settings.json` — stats and preferences - `library.json` — saved prompt library - `history.json` — optimization history ``` ```markdown 1. Never expose raw JSON 2. Keep all data LOCAL 3. Maximum 200 saved prompts, 500 history entries 4. Prompts may contain sensitive info — never share externally ``` ### Technical Analysis The Skill directs the agent to persist saved prompts and optimization history as JSON files under the user's home directory. It explicitly recognizes that prompts may contain sensitive information, but it does not prescribe restrictive permissions for the directory or files, encryption at rest, user consent before history collection, secret detection, or a defined retention and secure-deletion policy. The command `mkdir -p ~/.openclaw/prompt-optimizer` relies on the process umask to determine permissions. Likewise, the documented initialization process does not require files to be created with mode `0600`. On a host with a permissive umask or incorrectly configured home-directory access controls, other local users or processes may be able to read stored prompt content. The maximum-entry limits reduce unbounded growth but do not address confid ...[truncated 1802 chars]
- Remediation
- ## Remediation Suggestions 1. **Enforce restrictive directory permissions** - Create the directory with mode `0700`. - Verify and repair permissions if the directory already exists. - Example: ```bash install -d -m 700 "$HOME/.openclaw/prompt-optimizer" ``` 2. **Enforce restrictive file permissions** - Create `settings.json`, `library.json`, and `history.json` with mode `0600`. - Set a restrictive umask before creating or replacing files: ```bash umask 077 ``` - Reapply permissions after atomic file replacement. 3. **Make history retention opt-in** - Do not automatically retain complete prompts by default. - Ask for explicit user consent before enabling history. - Allow saving individual prompts without enabling global history. 4. **Minimize retained content** - Store metadata or redacted summaries instead of complete prompts when possible. - Detect and warn about likely passwords, API keys, access tokens, private keys, and other secrets before saving. - Refuse to persist identified credentials unless the user explicitly overrides the warning. 5. **Add lifecycle controls** - Provide commands to clear history, delete individual records, and delete all Skill data. - Add configurable time-based expiration in addition to entry-count limits. - Document whether deletion affects backups or synchronized home directories. 6. **Protect sensitive libraries** - Consider authenticated encryption for saved prompt content. - Keep encryption keys separate from the stored JSON files and use an operating-system credential store where available. 7. **Use safe file updates** - Write updates to securely created temporary files in the same protected directory. - Flush and atomically rename them into place. - Reject symbolic-link targets and verify file ownership before reading or overwriting existing files.