OpenClaw BaseCred SDK

• Outcome: Review
• Latest audit: Sep 10, 2026 · 5:13 PM UTC
• Version: 1.0.4

Overview

This skill appears to perform reputation lookups, but it should be reviewed because it reads a shared credential file and does not consistently pin the SDK it installs.

Before installing, consider whether you are comfortable with this skill reading ~/.openclaw/.env and exposing every value in that file to the Node process and its dependencies. Prefer running it with an isolated environment containing only TALENT_API_KEY and NEYNAR_API_KEY, verify that @basecred/sdk resolves to the reviewed version, and do not run the isolation test as an elevated user.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T05 · Unauthorized Access and Privilege Escalation

Warning

• Location: scripts/lib/basecred.mjs:13

Finding

Centralized OpenClaw Credential File Is Loaded Without Key-Level Isolation

Content

View full analysis

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: package.json:26

Finding

Reviewed SDK Version Is Not Consistently Pinned Across Installation Paths

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Note

• Location: test-isolation.sh:54

Finding

Predictable Shared Temporary File Allows Symlink-Based File Truncation

Content

View full analysis

/tmp/basecred-test-output.json 2>&1; then if grep -q '"availability"' /tmp/basecred-test-output.json; then echo " ✅ PASS: Skill executes and returns valid JSON" else echo " ❌ FAIL: Invalid JSON output" exit 1 fi else echo " ⚠️ WARNING: Skill execution failed (may need API keys)" fi rm -f /tmp/basecred-test-output.json ``` ### Technical Analysis The test writes to a fixed filename in the shared `/tmp` directory using ordinary shell redirection. Shell redirection follows symbolic links and truncates an existing target before executing the command. A local attacker who can write to `/tmp` can pre-create `/tmp/basecred-test-output.json` as a symbolic link to another file writable by the test runner. When the script runs, the linked target may be truncated and then receive command output. The final `rm -f` removes the link itself, not the target. ### Attack Path 1. A local attacker predicts the fixed path `/tmp/basecred-test-output.json`. 2. The attacker creates a symbolic link at that path pointing to a file writable by the intended test runner. 3. The user runs `test-isolation.sh`. 4. Shell redirection follows the symbolic link and opens the target with truncation. 5. The target file is erased or overwritten with reputation-test output. 6. The script removes the temporary pathname, potentially concealing the link used for the attack. ### Impact Assessment The attacker can cause truncation or corruption of an arbitrary file writable by the account running the test. Under normal nonprivileged execution, the scope is limited to that user's writable files. If the tes ...[truncated 259 chars]

Remediation

View remediation

"$tmp_file" 2>&1; then if grep -q '"availability"' "$tmp_file"; then echo " ✅ PASS: Skill executes and returns valid JSON" else echo " ❌ FAIL: Invalid JSON output" exit 1 fi fi ``` Additional hardening: 1. Never run this test with elevated privileges. 2. Quote every temporary pathname. 3. Use a private temporary directory with mode `0700` when multiple artifacts are required. 4. Ensure cleanup occurs on normal exit, errors, and signals through `trap`. ]]>

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Memory Poisoning: Persistent Context Injection, Context Window Stuffing, Memory Manipulation
• MCP Tool Poisoning: Hidden Instructions, Unicode Deception, Parameter Description Injection

Findings (41)

Memory Manipulation

High

• Category: Memory Poisoning
• Confidence: 80% confidence

Finding

Skill manipulates agent memory, state, or stored context. Memory corruption can alter personality, override safety rules, or cause unpredictable behavior.

Content

Scanner excerpt · PATCH-NOTES.md (reported line 76)May include surrounding context.

md

**Fix:** Added prominent security section at top of SKILL.md with:
- Link to SECURITY.md
- TL;DR of security guarantees
- Clear statement of hardcoded .env path

**Impact:** Users immediately see security posture before using skill.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PORTABILITY-FIX.md (reported line 30)May include surrounding context.

md

During security audit response, the focus was on proving "no directory traversal" by showing a concrete path. The path was documented correctly in SECURITY.md, but the **implementation was overly specific**.

The audit report claimed the script "walks up directories to find .env" — to disprove this, I showed the exact hardcoded path... but made it TOO hardcoded by including the specific username.

---

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · README.md (reported line 220)May include surrounding context.

md

During security audit response, the focus was on proving "no directory traversal" by showing a concrete path. The path was documented correctly in SECURITY.md, but the **implementation was overly specific**.

The audit report claimed the script "walks up directories to find .env" — to disprove this, I showed the exact hardcoded path... but made it TOO hardcoded by including the specific username.

---

Tp4

High

• Category: MCP Tool Poisoning
• Confidence: 97% confidence

Finding

The documented purpose is simple reputation lookup, but the observed behavior includes local source inspection, dependency auditing, filesystem access, and script execution unrelated to the advertised end-user function. This mismatch is dangerous because users may authorize a seemingly low-risk reputation skill while it performs broader local inspection and execution with greater privacy and integrity implications.

Content

No source excerpt is available for this finding.

Ae1

High

• Category: analysis-evasion
• Confidence: 100% confidence

Finding

Referenced artifact was not completely inspected

Content

Scanner excerpt · SKILL.md (reported line 30)May include surrounding context.

md

**This skill uses secure, hardcoded credential loading** — see [SECURITY.md](./SECURITY.md) for full audit details.

Credential Access

High

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Referencing the user's home directory and preparing to load .openclaw/.env establishes credential-access capability in the skill. In agent environments, this is dangerous because a library that can read local secret material may be repurposed or extended to expose credentials, and the access is not tightly limited to only the minimum needed inputs.

Content

Scanner excerpt · scripts/lib/basecred.mjs (reported line 13)May include surrounding context.

js

import { dirname, join } from 'path';
import { homedir } from 'os';

// Load environment variables from OpenClaw .env (user-agnostic)
const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);
const openclawEnvPath = join(homedir(), '.openclaw', '.env');

Credential Access

High

• Category: Privilege Escalation
• Confidence: 98% confidence

Finding

The dotenv.config call actively reads the .openclaw/.env file, importing any secrets in that file into process memory for use by this module. That creates real credential exposure risk in a plugin/skill context because the skill now depends on ambient local secrets and can use them for outbound authenticated requests without explicit per-call secret passing.

Content

Scanner excerpt · scripts/lib/basecred.mjs (reported line 16)May include surrounding context.

js

// Load environment variables from OpenClaw .env (user-agnostic)
const __filename = fileURLToPath(import.meta.url);
const __dirname = dirname(__filename);
const openclawEnvPath = join(homedir(), '.openclaw', '.env');
dotenv.config({ path: openclawEnvPath });

/**

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · SKILL.md (reported line 6)May include surrounding context.

md

{
  "name": "basecred-sdk-skill",
  "version": "1.0.1",
  "description": "Check human reputation via Ethos Network, Talent Protocol, and Farcaster using the neutral basecred-sdk. Fetches composable reputation data without judgment - raw scores, levels, and signals for identity verification and trust assessment.",
  "author": "teeclaw",
  "license": "MIT",
  "openclaw": {

Anti-Refusal Statement

High

• Category: Anti-Refusal
• Confidence: 80% confidence

Finding

Skill instructs the agent to omit warnings, disclaimers, or ethical commentary. Stripping safety caveats hides risk from the user and is a common jailbreak preamble.

Content

Scanner excerpt · skill.json (reported line 4)May include surrounding context.

json

{
  "name": "basecred-sdk-skill",
  "version": "1.0.1",
  "description": "Check human reputation via Ethos Network, Talent Protocol, and Farcaster using the neutral basecred-sdk. Fetches composable reputation data without judgment - raw scores, levels, and signals for identity verification and trust assessment.",
  "author": "teeclaw",
  "license": "MIT",
  "openclaw": {

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PATCH-NOTES.md (reported line 24)May include surrounding context.

md

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PATCH-NOTES.md (reported line 76)May include surrounding context.

md

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PATCH-NOTES.md (reported line 86)May include surrounding context.

md

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PATCH-NOTES.md (reported line 95)May include surrounding context.

md

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PATCH-NOTES.md (reported line 103)May include surrounding context.

md

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PATCH-NOTES.md (reported line 112)May include surrounding context.

md

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PORTABILITY-FIX.md (reported line 20)May include surrounding context.

md

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PORTABILITY-FIX.md (reported line 66)May include surrounding context.

md

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 5)May include surrounding context.

md

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 21)May include surrounding context.

md

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 57)May include surrounding context.

md

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · SECURITY.md (reported line 99)May include surrounding context.

md

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test-isolation.sh (reported line 2)May include surrounding context.

sh

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test-isolation.sh (reported line 9)May include surrounding context.

sh

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · test-isolation.sh (reported line 10)May include surrounding context.

sh

#!/bin/bash
# Isolation Test - Verify hardcoded .env path behavior
set -e

echo "🧪 basecred-sdk-skill Isolation Test"

Credential Access

High

• Category: Privilege Escalation
• Confidence: 60% confidence

Finding

Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.

Content

Scanner excerpt · PATCH-NOTES.md (reported line 58)May include surrounding context.

md

# Test 1: Verify dynamic .env path resolution
echo "✓ Test 1: Verify dynamic .env path (user-agnostic)"
if grep -q "homedir()" scripts/lib/basecred.mjs && grep -q "join(homedir(), '.openclaw', '.env')" scripts/lib/basecred.mjs; then
  echo "  ✅ PASS: Uses homedir() for portable path resolution"
else
  echo "  ❌ FAIL: Not using dynamic home directory resolution"

Static analysis

No suspicious patterns detected.