T09 · Insecure Skill Coding Practices
Error
- Location
references/credentials.md:15- Finding
Plaintext Storage of Reusable Salesforce Credentials
- Content
View full analysis
Vulnerability Details
File Location:
references/credentials.md, lines 15–24
Vulnerability Type: Plaintext sensitive credential storage
Risk Level: HighVulnerable Code Snippet
markdown Path: `~/.openclaw/credentials/salesforce.json` Format: ```json { "login_url": "https://mydomain.my.salesforce.com", "username": "user@example.com", "password": "your_password", "security_token": "optional_token" }text ### Technical Analysis The Skill instructs users to store a reusable Salesforce username, password, and optional security token in an unencrypted JSON file. It does not require restrictive file permissions, verify file ownership, reject symbolic links, require encryption at rest, or recommend a platform credential manager for this option. Salesforce authentication is necessary for the declared browser-driven functionality, so access to a suitable authentication mechanism is legitimate. However, direct plaintext access to reusable credentials exceeds the minimum privilege necessary when browser autofill, an operating-system credential manager, or short-lived OAuth credentials can be used instead. The Skill’s confirmation gates apply only while the Skill operates Salesforce. An attacker who obtains the credential file can authenticate independently and bypass those safeguards. ### Attack Path 1. A user follows the documented instructions and creates `~/.openclaw/credentials/salesforce.json`. 2. The file contains a reusable Salesforce password and potentially a security token in plaintext. 3. A malicious or compromised local process, another local account with sufficient filesystem access, or an insecure backup reads the file. 4. The attacker extracts the login URL, username, password, and security token. 5. The attacker authenticates to Salesforce outside the Skill, subject to Salesforce MFA, network, session, and account controls. 6. The attacker can then perform operations permitted by the compromised Salesforce account ...[truncated 748 chars]- Remediation
View remediation
Remediation Suggestions
- Remove plaintext password-file storage as a recommended authentication mechanism.
- Prefer browser-managed login, an operating-system keychain or credential manager, or Salesforce OAuth with short-lived, narrowly scoped tokens.
- If file-based storage must remain supported:
- Require owner-only permissions such as mode
0600. - Require the containing directory to be owner-only, such as mode
0700. - Validate that the file is owned by the expected user.
- Reject symbolic links and non-regular files before reading.
- Avoid storing long-lived passwords and security tokens where possible.
- Never print, log, return, or include credential values in diagnostic output.
- Document secure credential rotation and deletion procedures.
- Require owner-only permissions such as mode
- Use a dedicated Salesforce automation account with only the object, field, and administrative permissions required for the requested task.
- Retain MFA, conditional-access policies, login-IP restrictions, session controls, and Salesforce audit logging as defense-in-depth measures.