T09 · Insecure Skill Coding Practices
Error
- Location
src/cli.ts:259- Finding
Unnecessary Collection and Plaintext Storage of Cryptocurrency Private Keys
- Content
View full analysis
--private-key '); return; } ``` ```ts program .command('config') .description('Configure wallet for trading') .option('--wallet ', 'Wallet address') .option('--private-key ', 'Private key (stored securely)') .option('--show', 'Show current config') .action(async (options) => { if (options.show) { const config = loadConfig(); console.log('\n⚙️ Virtuals Configuration'); console.log('═══════════════════════════════════════'); console.log(` Wallet: ${config.wallet || 'Not set'}`); console.log(` Key: ${config.privateKey ? '••••••••' : 'Not set'}`); console.log('═══════════════════════════════════════'); return; } const config = loadConfig(); if (options.wallet) { config.wallet = options.wallet; } if (options.privateKey) { config.privateKey = options.privateKey; } saveConfig(config); console.log('✅ Configuration saved'); }); ``` The documented invocation also directs users to expose the key through a command-line argument: ```bash virtuals config --wallet --private-key ``` ### Technical Analysis The Skill requests a cryptocurrency private key as a command-line argument and persists it as unencrypted JSON in `~/.openclaw/virtuals/config.json`. ...[truncated 3057 chars]- Remediation
View remediation