OpenClaw BaseCred SDK

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:13 PM UTC
• Version: 1.0.4

Overview

This skill appears to perform reputation lookups, but it should be reviewed because it reads a shared credential file and does not consistently pin the SDK it installs.

Before installing, consider whether you are comfortable with this skill reading ~/.openclaw/.env and exposing every value in that file to the Node process and its dependencies. Prefer running it with an isolated environment containing only TALENT_API_KEY and NEYNAR_API_KEY, verify that @basecred/sdk resolves to the reviewed version, and do not run the isolation test as an elevated user.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/lib/basecred.mjs:13
• Finding: Centralized OpenClaw Credential File Is Loaded Without Key-Level Isolation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/lib/basecred.mjs:13-17` **Vulnerability Type**: Violation of least privilege through broad credential loading **Risk Level**: Medium ### Vulnerable Code ```javascript // Load environment variables from OpenClaw .env (user-agnostic) const __filename = fileURLToPath(import.meta.url); const __dirname = dirname(__filename); const openclawEnvPath = join(homedir(), '.openclaw', '.env'); dotenv.config({ path: openclawEnvPath }); ``` ### Technical Analysis The Skill requires only `TALENT_API_KEY` and `NEYNAR_API_KEY`, but `dotenv.config()` parses the entire centralized `~/.openclaw/.env` file and adds every available entry to `process.env`. All JavaScript dependencies executing in the same process can consequently access unrelated credentials loaded from that file. File mode `600` restricts other operating-system users, but it does not isolate credentials from third-party modules running inside the authorized Node.js process. The current audited code does not log or exfiltrate these unrelated values. The vulnerability is the unnecessary expansion of the credential boundary and the resulting increase in supply-chain impact. ### Attack Path 1. A user stores credentials for multiple OpenClaw components in `~/.openclaw/.env`. 2. The user invokes the reputation-checking Skill. 3. `dotenv.config()` imports all entries from the centralized file into `process.env`. 4. `@basecred/sdk` and other modules execute in the same process. 5. If a dependency is compromised or later replaced with malicious code, it can enumerate `process.env`. 6. The malicious dependency can read and transmit credentials unrelated to Talent Protocol or Neynar using the Skill's existing network access. ### Impact Assessment A malicious in-process dependency could obtain every credential imported from the centralized OpenClaw environment file, not merely the two credentials declared by this Skill. The exact scope depends on the conte ...[truncated 354 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Prefer OpenClaw runtime credential injection and expose only: - `TALENT_API_KEY` - `NEYNAR_API_KEY` 2. Launch the Skill with an allowlisted environment rather than importing a centralized credential file. 3. If runtime injection is unavailable, move credential extraction into a trusted bootstrap component and pass only the selected values to an isolated Skill process. 4. Avoid calling `dotenv.config()` against a shared credential store from a process that loads third-party packages. 5. Add an automated test that places a sentinel unrelated secret in the centralized environment and verifies that it is absent from the Skill process. 6. Document the precise credential boundary rather than claiming isolation based only on filesystem permissions. ]]>

T08 · Insecure Dependencies

Warning

• Location: package.json:26
• Finding: Reviewed SDK Version Is Not Consistently Pinned Across Installation Paths<![CDATA[ ## Vulnerability Details **File Locations**: `package.json:26-29`, `skill.json:27-32` **Vulnerability Type**: Unpinned third-party dependency installation **Risk Level**: Medium ### Vulnerable Code From `package.json`: ```json "dependencies": { "@basecred/sdk": "^0.6.2", "dotenv": "^16.3.1" } ``` From `skill.json`: ```json "install": [ { "id": "node", "kind": "node", "package": "@basecred/sdk", "label": "Install basecred SDK (npm)" } ] ``` ### Technical Analysis The documentation repeatedly states that `@basecred/sdk@0.6.2` was reviewed. However: - The caret range in `package.json` permits later semver-compatible `0.6.x` releases. - The OpenClaw installation declaration in `skill.json` contains no version constraint. - The lockfile currently resolves version `0.6.2` with an integrity hash, but an installer that follows `skill.json` independently may not use that lockfile. - A regenerated lockfile or installation path that does not honor it may retrieve code that was not part of the documented review. No malicious dependency is present in the supplied lockfile. The issue is that the stated reviewed-version guarantee is not enforced consistently. ### Attack Path 1. A later, compromised, or otherwise unsafe version of `@basecred/sdk` is published to the npm registry. 2. Installation occurs through the unversioned `skill.json` package declaration, or the lockfile is regenerated while the caret range remains active. 3. The package manager resolves a version other than the reviewed `0.6.2` release. 4. The Skill imports and executes the newly resolved package. 5. The dependency runs with the privileges of the Skill process, including access to network operations, reputation-query inputs, and credentials available in `process.env`. 6. Malicious runtime code or package lifecycle behavior can act under the invoking user's account. ### Impact Assessment A compromised resolved package could execute arbitrary JavaScript with t ...[truncated 410 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Replace the range in `package.json` with the exact reviewed version: ```json "@basecred/sdk": "0.6.2" ``` 2. Pin the Skill installer declaration explicitly: ```json "package": "@basecred/sdk@0.6.2" ``` 3. Continue committing `package-lock.json` and use `npm ci` rather than `npm install` for reproducible deployments. 4. Reject installation when the resolved package version or integrity hash differs from the reviewed lockfile. 5. Review package contents, lifecycle scripts, network behavior, and repository provenance before any version upgrade. 6. Keep package names, versions, and repository declarations synchronized across `package.json`, `package-lock.json`, `skill.json`, and documentation. ]]>

T09 · Insecure Skill Coding Practices

Note

• Location: test-isolation.sh:54
• Finding: Predictable Shared Temporary File Allows Symlink-Based File Truncation<![CDATA[ ## Vulnerability Details **File Location**: `test-isolation.sh:54-66` **Vulnerability Type**: Unsafe predictable temporary file **Risk Level**: Low ### Vulnerable Code ```bash # Test 5: Functional test (if credentials available) echo "✓ Test 5: Functional test (vitalik.eth)" if ./scripts/check-reputation.mjs 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045 --summary > /tmp/basecred-test-output.json 2>&1; then if grep -q '"availability"' /tmp/basecred-test-output.json; then echo " ✅ PASS: Skill executes and returns valid JSON" else echo " ❌ FAIL: Invalid JSON output" exit 1 fi else echo " ⚠️ WARNING: Skill execution failed (may need API keys)" fi rm -f /tmp/basecred-test-output.json ``` ### Technical Analysis The test writes to a fixed filename in the shared `/tmp` directory using ordinary shell redirection. Shell redirection follows symbolic links and truncates an existing target before executing the command. A local attacker who can write to `/tmp` can pre-create `/tmp/basecred-test-output.json` as a symbolic link to another file writable by the test runner. When the script runs, the linked target may be truncated and then receive command output. The final `rm -f` removes the link itself, not the target. ### Attack Path 1. A local attacker predicts the fixed path `/tmp/basecred-test-output.json`. 2. The attacker creates a symbolic link at that path pointing to a file writable by the intended test runner. 3. The user runs `test-isolation.sh`. 4. Shell redirection follows the symbolic link and opens the target with truncation. 5. The target file is erased or overwritten with reputation-test output. 6. The script removes the temporary pathname, potentially concealing the link used for the attack. ### Impact Assessment The attacker can cause truncation or corruption of an arbitrary file writable by the account running the test. Under normal nonprivileged execution, the scope is limited to that user's writable files. If the tes ...[truncated 259 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions Use `mktemp` to create a unique file securely and install a cleanup trap: ```bash tmp_file=$(mktemp "${TMPDIR:-/tmp}/basecred-test-output.XXXXXX") trap 'rm -f -- "$tmp_file"' EXIT if ./scripts/check-reputation.mjs \ 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045 \ --summary > "$tmp_file" 2>&1; then if grep -q '"availability"' "$tmp_file"; then echo " ✅ PASS: Skill executes and returns valid JSON" else echo " ❌ FAIL: Invalid JSON output" exit 1 fi fi ``` Additional hardening: 1. Never run this test with elevated privileges. 2. Quote every temporary pathname. 3. Use a private temporary directory with mode `0700` when multiple artifacts are required. 4. Ensure cleanup occurs on normal exit, errors, and signals through `trap`. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (41)

Memory Manipulation

High

• Category: Memory Poisoning

Content

**Fix:** Added prominent security section at top of SKILL.md with:
- Link to SECURITY.md
- TL;DR of security guarantees
- Clear statement of hardcoded .env path

**Impact:** Users immediately see security posture before using skill.

• Confidence: 80% confidence
• Finding: Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Credential Access

High

• Category: Privilege Escalation

Content

During security audit response, the focus was on proving "no directory traversal" by showing a concrete path. The path was documented correctly in SECURITY.md, but the **implementation was overly specific**.

The audit report claimed the script "walks up directories to find .env" — to disprove this, I showed the exact hardcoded path... but made it TOO hardcoded by including the specific username.

---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

During security audit response, the focus was on proving "no directory traversal" by showing a concrete path. The path was documented correctly in SECURITY.md, but the **implementation was overly specific**.

The audit report claimed the script "walks up directories to find .env" — to disprove this, I showed the exact hardcoded path... but made it TOO hardcoded by including the specific username.

---

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence
• Finding: The documented purpose is simple reputation lookup, but the observed behavior includes local source inspection, dependency auditing, filesystem access, and script execution unrelated to the advertised end-user function. This mismatch is dangerous because users may authorize a seemingly low-risk reputation skill while it performs broader local inspection and execution with greater privacy and integrity implications.

Ae1

High

• Category: analysis-evasion

Content

**This skill uses secure, hardcoded credential loading** — see [SECURITY.md](./SECURITY.md) for full audit details.

• Confidence: 100% confidence
• Finding: Referenced artifact was not completely inspected

Credential Access

High

• Category: Privilege Escalation

Content

import { dirname, join } from 'path';
import { homedir } from 'os';

// Load environment variables from OpenClaw .env (user-agnostic)
const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);
const openclawEnvPath = join(homedir(), '.openclaw', '.env');

• Confidence: 95% confidence
• Finding: Referencing the user's home directory and preparing to load .openclaw/.env establishes credential-access capability in the skill. In agent environments, this is dangerous because a library that can read local secret material may be repurposed or extended to expose credentials, and the access is not tightly limited to only the minimum needed inputs.

Credential Access

High

• Category: Privilege Escalation

Content

// Load environment variables from OpenClaw .env (user-agnostic)
const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);
const openclawEnvPath = join(homedir(), '.openclaw', '.env');
dotenv.config({ path: openclawEnvPath });

/**

• Confidence: 98% confidence
• Finding: The dotenv.config call actively reads the .openclaw/.env file, importing any secrets in that file into process memory for use by this module. That creates real credential exposure risk in a plugin/skill context because the skill now depends on ambient local secrets and can use them for outbound authenticated requests without explicit per-call secret passing.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

{
  "name": "basecred-sdk-skill",
  "version": "1.0.1",
  "description": "Check human reputation via Ethos Network, Talent Protocol, and Farcaster using the neutral basecred-sdk. Fetches composable reputation data without judgment - raw scores, levels, and signals for identity verification and trust assessment.",
  "author": "teeclaw",
  "license": "MIT",
  "openclaw": {

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Anti-Refusal Statement

High

• Category: Anti-Refusal

Content

{
  "name": "basecred-sdk-skill",
  "version": "1.0.1",
  "description": "Check human reputation via Ethos Network, Talent Protocol, and Farcaster using the neutral basecred-sdk. Fetches composable reputation data without judgment - raw scores, levels, and signals for identity verification and trust assessment.",
  "author": "teeclaw",
  "license": "MIT",
  "openclaw": {

• Confidence: 80% confidence
• Finding: Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Credential Access

High

• Category: Privilege Escalation

Content

# Test 1: Verify dynamic .env path resolution
echo "✓ Test 1: Verify dynamic .env path (user-agnostic)"
if grep -q "homedir()" scripts/lib/basecred.mjs && grep -q "join(homedir(), '.openclaw', '.env')" scripts/lib/basecred.mjs; then
  echo "  ✅ PASS: Uses homedir() for portable path resolution"
else
  echo "  ❌ FAIL: Not using dynamic home directory resolution"

• Confidence: 60% confidence
• Finding: Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Static analysis

No suspicious patterns detected.