T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:41
- Finding
- Cryptocurrency Private Key Exposed in Terminal Output and Stored Unencrypted## Vulnerability Details **File Location**: `SKILL.md:41-58` and `skill.json:30-32` **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: High ### Vulnerable Code ```bash # Generate a new Ethereum wallet using openssl PRIVATE_KEY=$(openssl rand -hex 32) echo "PRIVATE_KEY: 0x$PRIVATE_KEY" ``` ```bash WALLET_ADDRESS=$(cast wallet address --private-key "0x$PRIVATE_KEY") echo "WALLET_ADDRESS: $WALLET_ADDRESS" ``` ```bash echo "FXCLAW_WALLET_PRIVATE_KEY=0x$PRIVATE_KEY" >> ~/.fxclaw_wallet echo "FXCLAW_WALLET_ADDRESS=$WALLET_ADDRESS" >> ~/.fxclaw_wallet chmod 600 ~/.fxclaw_wallet ``` The behavior is also prescribed by the package configuration: ```json "registration": { "endpoint": "/api/v1/agents/register", "requiredFields": ["username", "walletAddress"], "optionalFields": ["displayName", "bio", "avatarUrl"], "notes": "walletAddress is REQUIRED. Ask your human if they have one. If they do, use it. If not, generate a new Ethereum wallet (openssl rand -hex 32), derive the address, and store the private key securely in a persistent file (~/.fxclaw_wallet)." } ``` ### Technical Analysis The Skill prints a newly generated Ethereum private key to standard output and appends it in plaintext to a predictable file in the user's home directory. File mode `0600` prevents access by other local operating-system users, but it does not provide encryption or protection from: - Compromised processes running as the same user. - Terminal transcripts, command logs, or captured agent output. - Unencrypted filesystem backups and snapshots. - Accidental inclusion of the file in diagnostic archives. - Malware or extensions operating in the user's security context. Appending with `>>` may also preserve obsolete keys in the same file. A cryptocurrency private key is a bearer secret: possession is sufficient to authorize transactions, and compromise generally cannot be reversed wit ...[truncated 939 chars]
- Remediation
- ## Remediation Suggestions - Prefer a user-provided wallet controlled through a hardware wallet or established wallet application. - Do not print private keys to standard output, logs, chat responses, or execution traces. - Store newly generated keys in an operating-system credential manager, hardware-backed keystore, or encrypted Ethereum keystore protected by a user-supplied secret. - Require explicit informed user approval before generating or storing a wallet key. - If a file is unavoidable, create it atomically with restrictive permissions before writing, rather than writing and applying `chmod` afterward. - Avoid append mode; reject an existing wallet file or use an explicit, secure rotation procedure. - Document backup, recovery, revocation, and asset-migration procedures. - Treat any key previously printed or stored through this workflow as potentially exposed and migrate its assets to a securely generated wallet.