T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:109- Finding
Hard-Coded Gateway Authentication Token in Documentation
- Content
View full analysis
~/.openclaw/gateway.token ``` ``` ### Technical Analysis The documentation embeds a concrete, high-entropy value and identifies it as a Gateway token. Unlike other examples that use redacted values or obvious placeholders, this command instructs users to install the exposed value as an authentication credential. If the token is valid, was previously valid, or is reused by any deployment, possession of the project is sufficient to recover it. Secrets committed to documentation should be treated as compromised because they may remain available through repository history, package mirrors, logs, and cached copies even after removal. ### Attack Path 1. An attacker obtains the publicly distributed Skill or its repository history. 2. The attacker extracts the hard-coded Gateway token from `SKILL.md`. 3. The attacker identifies a reachable OpenClaw Gateway using the same token. 4. The attacker presents the exposed token to the Gateway. 5. If the token remains valid and no additional control blocks access, the attacker obtains the access granted to that Gateway credential. ### Impact Assessment Successful exploitation could grant unauthorized access to an affected OpenClaw Gateway at the privilege level assigned to the token. The exact scope depends on Gateway configuration and network exposure. Deployments that never used this value are not directly affected, but the value must still be considered compromised. ]]>- Remediation
View remediation
`. 3. Search repository history, releases, logs, and distributed packages for the token. 4. Use secret-scanning controls in continuous integration to reject high-entropy credentials. 5. Prefer an interactive prompt or protected secret store rather than embedding credentials in documentation or commands. 6. Document restrictive token-file permissions, such as mode `0600`. ]]>