ClawHub
Back to skill

Security audit

Channels Setup

Security checks for vulnerabilities and agentic risk

Overview

This skill is a straightforward OpenClaw channel setup guide, though users should handle bot tokens and app secrets carefully.

Install/use this skill only when you intend to configure OpenClaw messaging channels. Treat all bot tokens, app secrets, gateway tokens, and passwords as sensitive: avoid pasting them into shared terminals or recorded sessions, rotate any credential that may have been exposed, and grant each integration only the minimum scopes it needs.

A.I.G

Vulnerability Patterns
  • Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
  • Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
  • Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
  • Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
  • Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (1)

T09 · Insecure Skill Coding Practices

Warning
Location
SKILL.md:23
Finding

Integration Secrets Exposed Through Command-Line Arguments

Content
View full analysis

Vulnerability Details

File Location: SKILL.md, lines 23–49
Vulnerability Type: Credentials passed directly as command-line arguments
Risk Level: Medium

The channel setup instructions tell users to substitute sensitive bot tokens and application secrets directly into shell commands:

bash
# Telegram — line 23
openclaw config set channels.telegram.botToken "YOUR_BOT_TOKEN"

# Discord — line 32
openclaw config set channels.discord.token "YOUR_BOT_TOKEN"

# Slack — lines 40–41
openclaw config set channels.slack.appToken "xapp-..."
openclaw config set channels.slack.botToken "xoxb-..."

# Feishu — line 49
openclaw config set channels.feishu.appSecret "YOUR_APP_SECRET"

Technical Analysis

Placing credentials directly in command-line arguments can expose them through shell history, terminal transcripts, session-recording systems, process monitoring, operating-system audit logs, debugging output, or support bundles. During command execution, some environments also make process arguments visible to other local processes or users through process inspection interfaces.

Although the file contains placeholders rather than real credentials, its documented workflow instructs users to replace those placeholders with live secrets. This creates an insecure credential-handling pattern. The resulting exposure depends on the host's shell configuration, process visibility controls, logging configuration, and access permissions.

Attack Path

  1. A user replaces a documented placeholder with a real Telegram, Discord, Slack, or Feishu credential.
  2. The user executes the resulting openclaw config set command.
  3. The command and its sensitive argument are retained in shell history, terminal/session logs, audit records, or process-monitoring data.
  4. An attacker with access to the affected local account, logs, monitoring system, support archive, or process metadata extracts the credential.
  5. The attacker ...[truncated 801 chars]
Remediation
View remediation

Remediation Suggestions

  1. Avoid accepting secrets as visible command-line arguments. Provide a protected interactive prompt or standard-input option that does not echo or record the secret.
  2. Support integration with an operating-system credential store or secrets manager and store only a secret reference in ordinary configuration.
  3. If file-based secret input is supported, instruct users to create the file with restrictive permissions, such as owner read/write access only, and securely remove it after import when appropriate.
  4. Clearly warn users not to paste credentials into shell commands, shared terminals, tickets, logs, or recorded sessions.
  5. Document how to inspect and securely remove affected shell-history entries, while noting that deletion from local history does not remove copies already collected by audit or session-recording systems.
  6. Recommend immediate rotation of any token or secret that may have been exposed, followed by review of integration activity and granted scopes.
  7. Apply least privilege to every bot and application credential so that disclosure has the smallest possible impact.

SkillSpector

Vulnerability Patterns
  • Prompt InjectionInstruction Override, Hidden Instructions, Exfiltration Commands
  • Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
  • Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
  • Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
  • Excessive AgencyUnrestricted Tool Access, Autonomous Decision Making, Scope Creep

Static analysis

No suspicious patterns detected.