T09 · Insecure Skill Coding Practices
- Location
schema-gateway.md:9- Finding
Hardcoded Token-Shaped Credential in Gateway Configuration Example
- Content
View full analysis
Vulnerability Details
File Location:
schema-gateway.md, lines 9–14
Vulnerability Type: Hardcoded authentication secret in a copyable configuration example
Risk Level: MediumVulnerable Code
json5 auth: { mode: "token", token: "c91c184aabe5ac6bb4e11de46770dbf10ae9e2636cbd771e", },Technical Analysis
The gateway authentication example contains a concrete 48-character hexadecimal token rather than an unmistakable placeholder or a reference to a protected secret source. The repository does not establish whether this token is active, so it must not be characterized as a confirmed leaked production credential. Nevertheless, presenting a fixed, credential-shaped value in directly copyable configuration creates an insecure deployment pattern.
A user may copy the example without generating a unique secret. Any deployment retaining this published value would use a credential known to everyone with access to the project. The risk becomes exploitable if the gateway is reachable through a LAN binding, tailnet, tunnel, public interface, or another forwarding mechanism.
Attack Path
- An operator copies the documented gateway configuration.
- The operator retains the published token instead of generating a unique credential.
- The gateway becomes reachable from an attacker-controlled network path.
- The attacker obtains the token from this public or shared project.
- The attacker submits the known token to the gateway authentication mechanism.
- If the copied token is accepted, the attacker gains the access granted to an authenticated gateway client.
Impact Assessment
Successful exploitation could permit unauthorized authenticated access to an affected OpenClaw gateway. The exact operations available would depend on the deployed gateway configuration, enabled tools, agent permissions, channel integrations, and network exposure.
The issue does not itself prove administrative or operating-system privilege escalation. Ho ...[truncated 193 chars]
- Remediation
View remediation
Remediation Suggestions
- Replace the concrete token with an explicit non-secret placeholder, for example:
json5 auth: { mode: "token", token: "${OPENCLAW_GATEWAY_TOKEN}", },- Document how to generate a unique, cryptographically secure token for every deployment.
- Store the token in an environment variable, secret manager, or protected configuration facility rather than committing it to source control.
- Add a warning that example credentials must never be reused.
- Ensure generated secrets have sufficient entropy and are rotated if exposure is suspected.
- Restrict gateway binding to
loopbackunless remote access is explicitly required. - Require authentication for every remotely reachable gateway and apply network-level access controls.
- Add documentation linting or secret-scanning checks that reject concrete credential-shaped values in examples.