T09 · Insecure Skill Coding Practices
Error
- Location
- openclaw.ts:3
- Finding
- Komodo API Credentials Can Be Transmitted over Plaintext HTTP<![CDATA[ ## Vulnerability Details **File Location**: `openclaw.ts:3-13`; credential transmission is implemented in the bundled client at `scripts/run.js:732-750` and duplicated in all generated `scripts/*.js` entry points. **Vulnerability Type**: Missing transport security enforcement for sensitive credentials **Risk Level**: High ### Vulnerable Code ```typescript const url = process.env.KOMODO_URL; const key = process.env.KOMODO_API_KEY; const secret = process.env.KOMODO_API_SECRET; if (!url) throw new Error("Missing env: KOMODO_URL"); if (!key) throw new Error("Missing env: KOMODO_API_KEY"); if (!secret) throw new Error("Missing env: KOMODO_API_SECRET"); export const komodo = KomodoClient(url, { type: "api-key", params: { key, secret }, }); ``` The bundled client transmits these values as HTTP headers: ```javascript function KomodoClient(url, options) { const state = { jwt: options.type === "jwt" ? options.params.jwt : undefined, key: options.type === "api-key" ? options.params.key : undefined, secret: options.type === "api-key" ? options.params.secret : undefined }; const request = (path, type, params) => new Promise(async (res, rej) => { try { let response = await fetch(`${url}${path}/${type}`, { method: "POST", body: JSON.stringify(params), headers: { ...state.jwt ? { authorization: state.jwt } : state.key && state.secret ? { "x-api-key": state.key, "x-api-secret": state.secret } : {}, "content-type": "application/json" } }); ``` ### Technical Analysis `KOMODO_URL` is accepted directly from the environment without parsing its scheme or requiring HTTPS. Although the documentation gives HTTPS examples, the implementation also accepts an address beginning with `http://`. Every API request includes the API key and secret in request headers. If the configured endpoint uses HTTP, both credentials and infrastr ...[truncated 1736 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Parse `KOMODO_URL` with the standard `URL` class before initializing the client. 2. Require the `https:` protocol by default and terminate execution for `http:` or other schemes. 3. If plaintext HTTP is necessary for isolated local development, require an explicit development-only override such as `KOMODO_ALLOW_INSECURE_HTTP=true` and print a prominent warning. 4. Reject URLs containing embedded usernames or passwords. 5. Consider restricting the configured hostname or origin in managed deployments so configuration manipulation cannot redirect credentials to an attacker-controlled server. 6. Use a narrowly scoped Komodo API identity for this Skill, granting only the read, write, or execute permissions required for intended operations. 7. Rotate the API credentials if they may previously have been used over HTTP. Example validation: ```typescript const endpoint = new URL(url); if (endpoint.protocol !== "https:") { const allowInsecure = process.env.KOMODO_ALLOW_INSECURE_HTTP === "true" && (endpoint.hostname === "localhost" || endpoint.hostname === "127.0.0.1"); if (!allowInsecure) { throw new Error("KOMODO_URL must use HTTPS"); } } if (endpoint.username || endpoint.password) { throw new Error("KOMODO_URL must not contain embedded credentials"); } ``` ]]>