Security audit
Security checks for vulnerabilities and agentic risk
This looks like a real secret-transfer tool, but it can read local secrets and upload them to a third-party one-time-link service when asked.
Install only in environments where chat users are trusted operators or where you can enforce who may request outbound shares. Prefer self-hosted or organization-approved providers, restrict which files or secret names agents may export, and avoid using the outbound share feature for production credentials unless there is a separate approval process.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
│ │ │ (silent CLI ingest) ▼ ▼ [Link Burned] ~/.openclaw/.env (atomic mode 0600)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
│ │ │ (silent CLI ingest) ▼ ▼ [Link Burned] ~/.openclaw/.env (atomic mode 0600)
The skill documentation permits writing secrets to files, modifying configuration/state, and optionally restarting the gateway, yet frames itself mainly as one-time link handling. Those side effects materially increase operational and security impact because a misused or compromised skill could persist secrets locally and alter runtime state.
The skill documentation permits writing secrets to files, modifying configuration/state, and optionally restarting the gateway, yet frames itself mainly as one-time link handling. Those side effects materially increase operational and security impact because a misused or compromised skill could persist secrets locally and alter runtime state.
The skill documentation permits writing secrets to files, modifying configuration/state, and optionally restarting the gateway, yet frames itself mainly as one-time link handling. Those side effects materially increase operational and security impact because a misused or compromised skill could persist secrets locally and alter runtime state.
The skill documentation permits writing secrets to files, modifying configuration/state, and optionally restarting the gateway, yet frames itself mainly as one-time link handling. Those side effects materially increase operational and security impact because a misused or compromised skill could persist secrets locally and alter runtime state.
The skill documentation permits writing secrets to files, modifying configuration/state, and optionally restarting the gateway, yet frames itself mainly as one-time link handling. Those side effects materially increase operational and security impact because a misused or compromised skill could persist secrets locally and alter runtime state.
The outbound procedure explicitly supports reading named secrets from ~/.openclaw/.env and returning a one-time URL. Even if plaintext is not echoed, this is credential access capability, and if invoked by an unauthorized requester or without strong access checks it enables exfiltration of stored secrets.
Use only the local source authorized by the request:
# ~/.openclaw/.env
python3 <skill-directory>/scripts/secret-drop share \
--from openclaw-env \
--name "VARIABLE_NAME" \
The skill allows reading secrets from arbitrary project dotenv paths and exporting them via a one-time link. This is sensitive because project .env files commonly contain production credentials, and path-based access broadens exposure to many local secrets if the skill is misused.
# Project dotenv
python3 <skill-directory>/scripts/secret-drop share \
--from dotenv \
--path "/path/to/.env" \
--name "VARIABLE_NAME" \
--json
This example shows reading a database credential from /srv/acme/.env and sharing it outward, which is a direct credential disclosure workflow. The skill context makes this more dangerous because it normalizes secret extraction from local storage and transmission to a requester without any visible access-control, redaction, or out-of-band approval step.
python3 <skill-directory>/scripts/secret-drop share \
--from dotenv \
--path /srv/acme/.env \
--name DATABASE_URL \
--json
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def default_openclaw_env_path() -> Path:
state_dir = os.environ.get("OPENCLAW_STATE_DIR") or str(Path.home() / ".openclaw")
return Path(state_dir).expanduser() / ".env"
def format_assignment(name: str, value: str) -> str:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def default_openclaw_env_path() -> Path:
state_dir = os.environ.get("OPENCLAW_STATE_DIR") or str(Path.home() / ".openclaw")
return Path(state_dir).expanduser() / ".env"
def format_assignment(name: str, value: str) -> str:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def default_openclaw_env_path() -> Path:
state_dir = os.environ.get("OPENCLAW_STATE_DIR") or str(Path.home() / ".openclaw")
return Path(state_dir).expanduser() / ".env"
def format_assignment(name: str, value: str) -> str:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def default_openclaw_env_path() -> Path:
state_dir = os.environ.get("OPENCLAW_STATE_DIR") or str(Path.home() / ".openclaw")
return Path(state_dir).expanduser() / ".env"
def format_assignment(name: str, value: str) -> str:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def default_openclaw_env_path() -> Path:
state_dir = os.environ.get("OPENCLAW_STATE_DIR") or str(Path.home() / ".openclaw")
return Path(state_dir).expanduser() / ".env"
def format_assignment(name: str, value: str) -> str:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
def default_openclaw_env_path() -> Path:
state_dir = os.environ.get("OPENCLAW_STATE_DIR") or str(Path.home() / ".openclaw")
return Path(state_dir).expanduser() / ".env"
def format_assignment(name: str, value: str) -> str:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
netloc = parts.hostname or ""
if parts.port:
netloc = f"{netloc}:{parts.port}"
# Query values can carry passphrases or access tokens. Error messages do not
# need them, so drop the whole query instead of trying to classify every key.
return urlunsplit((parts.scheme, netloc, _sanitize_path(parts.path), "", ""))
except Exception:
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
)
def test_rejects_symlink_secret_source(self) -> None:
target = self.root / "secret.txt"
target.write_text("hidden-secret", encoding="utf-8")
link = self.root / "secret-link.txt"
link.symlink_to(target)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
)
def test_rejects_symlink_secret_source(self) -> None:
target = self.root / "secret.txt"
target.write_text("hidden-secret", encoding="utf-8")
link = self.root / "secret-link.txt"
link.symlink_to(target)
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
)
def test_rejects_symlink_secret_source(self) -> None:
target = self.root / "secret.txt"
target.write_text("hidden-secret", encoding="utf-8")
link = self.root / "secret-link.txt"
link.symlink_to(target)
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
## [0.2.0] - 2026-09-19
- Add `secret-drop share` command to create short-lived Password Pusher links from local `.env`, `~/.openclaw/.env`, or raw secret files without exposing plaintext.
- Rewrite `SKILL.md` into a concise decision matrix for AI agents covering inbound drops, chat masking recovery, and outbound sharing.
- Require Password Pusher retrieval-step handovers to preserve the API-returned
`html_url` ending in `/r`; bare `/p/<token>` links can be consumed by messenger
The workflow intentionally creates retrievable secret-bearing links and sends them through chat platforms, which introduces a persistence and interception surface outside the host even if links are single-use and expiring. Link previews, message retention, compromised chat accounts, provider-side logging, or race conditions on retrieval could allow unauthorized access before the intended agent consumes the secret.
(atomic mode 0600)
1. You create an expiring single-use link on an established secret sharing service.
2. You send only the retrieval-step link to your agent in chat: `"Set OPENROUTER_API_KEY from https://eu.pwpush.com/p/abc12345/r"`.
3. The agent invokes `secret-drop`.
4. The CLI fetches the secret in-process and writes it atomically to the desired target (`~/.openclaw/.env`, local `.env`, or OpenClaw SQLite secret store). A provider configured for one retrieval consumes or expires the drop.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
git clone https://github.com/sprintberlin/openclaw-secret-drop.git cd openclaw-secret-drop pip install -r requirements.txt sudo ln -s $(pwd)/scripts/secret-drop /usr/local/bin/secret-drop
---
The README explicitly documents a feature to share secrets outbound through third-party services, but it does not prominently warn that this transmits plaintext secrets off-host to external infrastructure and may place them under another party's control. Even if the service is designed for one-time secret exchange, users may underestimate the trust, retention, logging, jurisdiction, and compromise risks of using external secret-sharing providers.
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
## Security Guarantees
- **No Output Leakage:** The CLI strictly suppresses secrets on `stdout`, `stderr`, and exit codes.
- **Atomic File Writes:** Writes use temporary files in the target directory, `fchmod 0600`, `fsync`, and atomic `os.replace`. The destination is checked again with `lstat` immediately before replacement to reject a late symlink swap.
- **SSRF Guardrails:** The HTTP client requires HTTPS, rejects URL userinfo, validates every redirect, and rejects the request if any resolved A/AAAA result is private, loopback, link-local, multicast, reserved, unspecified, or scoped. Self-hosted private instances require explicit `--allow-private-host`. This is defense in depth, not a replacement for host network policy.
- **URL Redaction:** Provider identifiers in `/p/<token>` and `/g/<id>` paths, query strings, and fragments are masked in status and error output.
- **No false erase promise:** Python cannot guarantee erasure of immutable strings or SSD/journal history. The design minimizes copies and never emits plaintext; use a protected OpenClaw store or external secret manager when stronger storage isolation is required.
No suspicious patterns detected.