T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:25
- Finding
- Insecure Collection and Plaintext Storage of an API Credential<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 25–30 **Vulnerability Type**: Plaintext sensitive-data handling and unnecessary credential disclosure **Risk Level**: Medium ### Vulnerable Code ```markdown If STOLABS_API_KEY is not set: 1. Tell the user to sign up at https://app.638labs.com 2. Tell them to go to Account > API Keys and copy their key 3. Ask them to provide the key 4. Save it to ~/.openclaw/.env as STOLABS_API_KEY=key-xxxx 5. Confirm setup is complete ``` ### Technical Analysis The setup procedure directs the Agent to ask the user to provide an API key through the conversation and then save that credential as plaintext in `~/.openclaw/.env`. Requiring an API key is consistent with the Skill's declared external service integration. However, collecting the key through the Agent conversation exceeds the minimum privilege necessary because the user could configure `STOLABS_API_KEY` directly through a trusted local interface or secret manager. A credential disclosed in a conversation may be retained in session history, application telemetry, debugging output, model-provider logs, or audit records. Storing the key in a plaintext environment file creates an additional exposure point. The instructions do not require restrictive file permissions, atomic file updates, preservation of existing configuration, or redaction of the credential from subsequent output. The file path is under the current user's home directory, so this does not by itself establish system-level privilege escalation. Nevertheless, it grants the Agent access to a reusable authentication secret and permission to modify persistent user configuration. ### Attack Path 1. The Skill determines that `STOLABS_API_KEY` is not currently configured. 2. Following the setup instructions, the Agent asks the user to paste the API key into the conversation. 3. The credential becomes part of the conversation and may consequently appear in session storage, logs, telemetry, ...[truncated 990 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not ask users to paste API keys into the Agent conversation. 2. Direct users to configure `STOLABS_API_KEY` themselves through a trusted local secret-entry mechanism, operating-system credential store, or supported secrets manager. 3. If file-based storage is unavoidable: - Create or update the file locally without exposing the value to the model. - Enforce owner-only permissions such as mode `0600`. - Update the file atomically. - Preserve existing variables rather than overwriting the entire file. - Validate the destination path and reject symbolic-link redirection. 4. Never print, repeat, or include the credential in confirmations, errors, telemetry, or debugging logs. 5. Confirm setup only by checking whether the variable is available, without returning its value. 6. Recommend narrowly scoped, revocable API keys with spending limits or quotas where supported. 7. Document credential rotation and revocation procedures for users who may already have disclosed a key in conversation history. ]]>