T09 · Insecure Skill Coding Practices
- Location
SKILL.md:16- Finding
API Key Disclosure Through Terminal Output
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md:16Vulnerability Type: Sensitive credential exposure through command output Risk Level: MediumVulnerable Code
markdown 1. **OPENROUTER_API_KEY is set.** Check with `echo $OPENROUTER_API_KEY`. If empty, the user must get a free key at https://openrouter.ai/keys and set it:Technical Analysis
The Skill instructs the Agent to run
echo $OPENROUTER_API_KEYto determine whether the OpenRouter credential is configured. This prints the complete secret to standard output.Command output may be captured in Agent conversation history, execution logs, terminal scrollback, telemetry, screenshots, or debugging records. Checking whether an environment variable exists does not require revealing its value, so this behavior exceeds the minimum disclosure necessary for the declared functionality.
The implementation itself sends the key only to OpenRouter API endpoints as a bearer credential. The vulnerability is specifically the instruction to expose the complete key locally through terminal output.
Attack Path
- A user or Agent follows the prerequisite instructions in
SKILL.md. - The command
echo $OPENROUTER_API_KEYis executed. - The shell expands the variable and writes the complete API key to standard output.
- The output is retained in an Agent transcript, execution log, telemetry record, terminal history capture, or screenshot.
- An attacker with access to that retained output extracts the key.
- The attacker uses the credential to authenticate to OpenRouter within the permissions and limits assigned to the key.
Impact Assessment
Disclosure grants the attacker the same OpenRouter API access as the exposed key. The attacker may consume associated quota, invoke models, generate usage attributable to the victim, or access other API functionality authorized for that credential.
This does not directly grant local operating-system priv ...[truncated 189 chars]
- A user or Agent follows the prerequisite instructions in
- Remediation
View remediation
Remediation Suggestions
Replace the value-printing command with a presence-only test:
bash if test -n "${OPENROUTER_API_KEY:-}"; then echo "OPENROUTER_API_KEY is set" else echo "OPENROUTER_API_KEY is not set" fiAdditional hardening measures:
- Never print, log, or include the complete credential in Agent responses.
- If a key identifier must be displayed, use a short masked representation and avoid exposing enough characters to aid recovery.
- Recommend revoking and rotating any key that has already appeared in transcripts or logs.
- Document that command output and Agent transcripts should be treated as potentially persistent records.
- Prefer environment-based secret injection or a dedicated secret manager over plaintext storage in
~/.openclaw/openclaw.json.