T09 · Insecure Skill Coding Practices
- Location
SKILL.md:35- Finding
Potentially Sensitive Prompts Stored in Plaintext Without Explicit Access Controls
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:35-59,SKILL.md:65-69, andSKILL.md:972-975
Vulnerability Type: Insecure storage of potentially sensitive user data
Risk Level: MediumVulnerable Code
markdown On first message, create data directory: ```bash mkdir -p ~/.openclaw/prompt-optimizerInitialize files:
json // ~/.openclaw/prompt-optimizer/settings.json { "default_model": "any", "prompts_optimized": 0, "templates_used": 0, "prompts_saved": 0, "streak_days": 0 }json // ~/.openclaw/prompt-optimizer/library.json []json // ~/.openclaw/prompt-optimizer/history.json []text ```markdown All data stored under `~/.openclaw/prompt-optimizer/`: - `settings.json` — stats and preferences - `library.json` — saved prompt library - `history.json` — optimization historymarkdown 1. Never expose raw JSON 2. Keep all data LOCAL 3. Maximum 200 saved prompts, 500 history entries 4. Prompts may contain sensitive info — never share externallyTechnical Analysis
The Skill directs the agent to persist saved prompts and optimization history as JSON files under the user's home directory. It explicitly recognizes that prompts may contain sensitive information, but it does not prescribe restrictive permissions for the directory or files, encryption at rest, user consent before history collection, secret detection, or a defined retention and secure-deletion policy.
The command
mkdir -p ~/.openclaw/prompt-optimizerrelies on the process umask to determine permissions. Likewise, the documented initialization process does not require files to be created with mode0600. On a host with a permissive umask or incorrectly configured home-directory access controls, other local users or processes may be able to read stored prompt content.The maximum-entry limits reduce unbounded growth but do not address confid ...[truncated 1802 chars]
- Remediation
View remediation
Remediation Suggestions
-
Enforce restrictive directory permissions
- Create the directory with mode
0700. - Verify and repair permissions if the directory already exists.
- Example:
bash install -d -m 700 "$HOME/.openclaw/prompt-optimizer"
- Create the directory with mode
-
Enforce restrictive file permissions
- Create
settings.json,library.json, andhistory.jsonwith mode0600. - Set a restrictive umask before creating or replacing files:
bash umask 077 - Reapply permissions after atomic file replacement.
- Create
-
Make history retention opt-in
- Do not automatically retain complete prompts by default.
- Ask for explicit user consent before enabling history.
- Allow saving individual prompts without enabling global history.
-
Minimize retained content
- Store metadata or redacted summaries instead of complete prompts when possible.
- Detect and warn about likely passwords, API keys, access tokens, private keys, and other secrets before saving.
- Refuse to persist identified credentials unless the user explicitly overrides the warning.
-
Add lifecycle controls
- Provide commands to clear history, delete individual records, and delete all Skill data.
- Add configurable time-based expiration in addition to entry-count limits.
- Document whether deletion affects backups or synchronized home directories.
-
Protect sensitive libraries
- Consider authenticated encryption for saved prompt content.
- Keep encryption keys separate from the stored JSON files and use an operating-system credential store where available.
-
Use safe file updates
- Write updates to securely created temporary files in the same protected directory.
- Flush and atomically rename them into place.
- Reject symbolic-link targets and verify file ownership before reading or overwriting existing files.
-