T09 · Insecure Skill Coding Practices
Warning
- Location
core/util/secrets.py:30- Finding
OAuth Refresh Token Exposed Through Process Command-Line Arguments
- Content
View full analysis
``` Command-line arguments can be exposed through process inspection facilities, endpoint monitoring, audit systems, diagnostic tooling, or crash telemetry. Although the writeback path is opt-in through `OPENCLAW_1P_WRITEBACK=1`, enabling the documented token-management feature creates this exposure whenever a provider rotates its refresh token. Using `subprocess.run` with a list prevents shell injection, but it does not protect secrets placed in process arguments. ### Attack Path 1. The user enables 1Password token writeback by setting `OPENCLAW_1P_WRITEBACK=1`. 2. WHOOP or Withings rotates an OAuth refresh token during an ordinary API refresh. 3. The connector passes the new token to `set_secret`. 4. `set_secret` creates an `op item edit` process whose argument list includes the plaintext refresh token. 5. A local process monitor, audit collector, diagnostic agent, or sufficiently privileged local user records or reads the command-line arguments while the process is running. 6. The captured refresh token is submitted to the corresponding provider's OAuth token endpoint with any additionally required client credentials. 7. If the token remains valid and the other OAuth requirements are met, the attacker obtains an acces ...[truncated 645 chars]- Remediation
View remediation