T09 · Insecure Skill Coding Practices
Error
- Location
- references/credentials.md:15
- Finding
- Plaintext Storage of Reusable Salesforce Credentials## Vulnerability Details **File Location**: `references/credentials.md`, lines 15–24 **Vulnerability Type**: Plaintext sensitive credential storage **Risk Level**: High ### Vulnerable Code Snippet ```markdown Path: `~/.openclaw/credentials/salesforce.json` Format: ```json { "login_url": "https://mydomain.my.salesforce.com", "username": "user@example.com", "password": "your_password", "security_token": "optional_token" } ``` ``` ### Technical Analysis The Skill instructs users to store a reusable Salesforce username, password, and optional security token in an unencrypted JSON file. It does not require restrictive file permissions, verify file ownership, reject symbolic links, require encryption at rest, or recommend a platform credential manager for this option. Salesforce authentication is necessary for the declared browser-driven functionality, so access to a suitable authentication mechanism is legitimate. However, direct plaintext access to reusable credentials exceeds the minimum privilege necessary when browser autofill, an operating-system credential manager, or short-lived OAuth credentials can be used instead. The Skill’s confirmation gates apply only while the Skill operates Salesforce. An attacker who obtains the credential file can authenticate independently and bypass those safeguards. ### Attack Path 1. A user follows the documented instructions and creates `~/.openclaw/credentials/salesforce.json`. 2. The file contains a reusable Salesforce password and potentially a security token in plaintext. 3. A malicious or compromised local process, another local account with sufficient filesystem access, or an insecure backup reads the file. 4. The attacker extracts the login URL, username, password, and security token. 5. The attacker authenticates to Salesforce outside the Skill, subject to Salesforce MFA, network, session, and account controls. 6. The attacker can then perform operations permitted by the compromised Salesforce account ...[truncated 748 chars]
- Remediation
- ## Remediation Suggestions 1. Remove plaintext password-file storage as a recommended authentication mechanism. 2. Prefer browser-managed login, an operating-system keychain or credential manager, or Salesforce OAuth with short-lived, narrowly scoped tokens. 3. If file-based storage must remain supported: - Require owner-only permissions such as mode `0600`. - Require the containing directory to be owner-only, such as mode `0700`. - Validate that the file is owned by the expected user. - Reject symbolic links and non-regular files before reading. - Avoid storing long-lived passwords and security tokens where possible. - Never print, log, return, or include credential values in diagnostic output. - Document secure credential rotation and deletion procedures. 4. Use a dedicated Salesforce automation account with only the object, field, and administrative permissions required for the requested task. 5. Retain MFA, conditional-access policies, login-IP restrictions, session controls, and Salesforce audit logging as defense-in-depth measures.