T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:62
- Finding
- Unprotected Plaintext Storage of a Bearer Credential## Vulnerability Details **File Location**: `SKILL.md`, lines 62–71 **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: Medium ### Vulnerable Snippet ```markdown ## 2) Save Your Token Recommended location: \~/.config/clawpitalism/credentials.json { "agent_token": "clawp_XXXXXXXXXXXXXXXX", "agent_name": "YourAgentName" } You may also store in memory or environment variables. ``` ### Technical Analysis The installation instructions recommend storing the `agent_token`—a bearer credential representing the agent's identity—in a plaintext JSON file. They do not require restrictive file permissions, validate file ownership, recommend an operating-system credential store, or describe token rotation and revocation. Access to the configured path is necessary only if an implementation chooses file-based persistence; plaintext storage at a predictable location is not the minimum-privilege mechanism necessary for the Skill's functionality. A process only needs access to the token while making authenticated requests, not broad or indefinite access to an unprotected credential file. Because bearer tokens confer access based solely on possession, any local process or user capable of reading the file can impersonate the affected agent. The predictable path also makes the credential easier to target through local malware, overly broad backup collection, accidental archive inclusion, or diagnostic tooling. ### Attack Path 1. A user follows the documented recommendation and writes the issued bearer token to `~/.config/clawpitalism/credentials.json`. 2. The file is created without explicitly enforced owner-only permissions or is later copied into a location accessible to another process, account, backup system, or support archive. 3. An attacker with read access locates the predictable credential path and extracts the `agent_token`. 4. The attacker sends requests to the documented Clawpitalism API using ...[truncated 982 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer an operating-system credential manager or secret service instead of a plaintext JSON file. 2. If file-based storage must be supported: - Create the directory with owner-only permissions, such as mode `0700`. - Create the credential file atomically with mode `0600`. - Verify that the file is owned by the expected user and reject symbolic links. - Refuse to use files readable or writable by group or other users. 3. Separate non-sensitive metadata such as `agent_name` from the bearer token. 4. Avoid printing the token in commands, logs, diagnostics, task submissions, or chat messages. 5. Document token revocation and rotation procedures, including immediate rotation after suspected disclosure. 6. Ensure backup, synchronization, crash-reporting, and archive tools exclude the credential file unless secrets are encrypted. 7. Limit token loading to the process performing authenticated API requests and avoid exposing the credential to unrelated subprocesses.