T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:181- Finding
Plaintext Storage of WeChat Credentials and Access Tokens
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 181–199
Vulnerability Type: Plaintext sensitive-data storage
Risk Level: MediumThe documented configuration instructs users to store a WeChat application secret and cached access token in plaintext files under the user's home directory. It does not prescribe restrictive permissions, ownership validation, encryption, or integration with a secure credential store.
markdown ## Configuration Create a configuration file at `~/.openclaw/config/wechat-mp.json`: ```json { "app_id": "your-wechat-app-id", "app_secret": "your-wechat-app-secret", "default_author": "默认作者名", "access_token_cache_file": "~/.openclaw/.wechat_mp_token.json" }Or use environment variables:
bash export WECHAT_MP_APP_ID="your-app-id" export WECHAT_MP_APP_SECRET="your-app-secret" export WECHAT_MP_DEFAULT_AUTHOR="默认作者" export WECHAT_MP_TOKEN_CACHE="~/.openclaw/.wechat_mp_token.json"text ### Technical Analysis The application secret is a long-lived authentication credential, while the token cache may contain an immediately usable bearer token. Plaintext storage without explicit access-control requirements can expose these values to other local users, compromised processes, backup systems, diagnostic tooling, or accidental file publication. The environment-variable alternative does not completely mitigate the issue. Environment variables may be inherited by child processes or exposed through debugging, crash-reporting, or process-inspection mechanisms, depending on the host environment. The artifact contains only `SKILL.md`; therefore, the implementation of token-cache creation, file permissions, atomic writes, logging, and credential handling could not be verified. The finding is specifically based on the insecure configuration procedure documented in the supplied artifact. ### Attack Path 1. A user follows the documented procedure and places ...[truncated 1428 chars]- Remediation
View remediation
Remediation Suggestions
- Store the WeChat application secret in an operating-system keychain, managed secret service, or equivalent protected credential store rather than in a plaintext JSON file.
- If file-based storage is unavoidable, create the configuration and token-cache files with mode
0600and their parent directories with mode0700. - Validate file ownership, type, and permissions before reading credentials. Reject symbolic links, files owned by another user, and files with group or world access.
- Write cached tokens atomically by creating a securely permissioned temporary file in the same protected directory and then renaming it into place.
- Never include application secrets or access tokens in logs, exceptions, telemetry, command output, or returned tool data. Redact sensitive values consistently.
- Avoid broadly exported environment variables where possible. If environment variables must be supported, document inheritance and diagnostic-exposure risks and restrict their lifetime to the relevant process.
- Apply least privilege to the associated WeChat application, rotate credentials periodically, and document immediate credential revocation and token invalidation procedures.
- Add explicit secure-setup instructions and automated permission checks to the skill documentation and implementation.
- Include the referenced source code, package manifest, lockfile, and tests in the distributed artifact so reviewers can verify that credential handling follows the documented security controls.