T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:40
- Finding
- Binance API Credentials Stored in a Plaintext File Without Required Access Controls## Vulnerability Details **File Location**: `SKILL.md:40-48` **Vulnerability Type**: Plaintext storage of sensitive trading credentials **Risk Level**: Medium ### Vulnerable Code ```markdown ### Setup Credentials Save to `~/.openclaw/credentials/binance.json`: ```json { "apiKey": "YOUR_API_KEY", "secretKey": "YOUR_SECRET_KEY" } ``` ``` ### Technical Analysis The setup instructions direct users to persist a Binance API key and secret key in an unencrypted JSON file. They do not require restrictive permissions for either the credential directory or the file. The credential storage is relevant to the documented authenticated Binance operations, but storing secrets without specifying access controls is not the minimum safe privilege model. Depending on the user's default `umask`, operating system configuration, backup tooling, and host tenancy, the file may be readable by unintended local users or processes. The executable analysis script does not read this credential file and only retrieves public market data. No code was found that exfiltrates credentials, and the documented authenticated requests target official Binance domains. The risk therefore arises from insecure credential-storage guidance rather than confirmed malicious behavior. ### Attack Path 1. A user follows the setup instructions and creates `~/.openclaw/credentials/binance.json`. 2. The file is created under permissive default permissions or becomes accessible through backups, diagnostics, or another local process. 3. An attacker with local filesystem access reads `apiKey` and `secretKey`. 4. The attacker uses the credentials to sign Binance API requests. 5. If the key has account-read or trading permissions, the attacker accesses account information or submits unauthorized orders. Additional effects depend on the permissions configured for the compromised key. This path requires an attacker to gain access to the credential file throu ...[truncated 702 chars]
- Remediation
- ## Remediation Suggestions 1. Prefer an operating-system keychain or dedicated secret manager instead of a plaintext JSON file. 2. If file storage is necessary, document secure creation explicitly: ```bash install -d -m 700 "$HOME/.openclaw/credentials" umask 077 cat > "$HOME/.openclaw/credentials/binance.json" chmod 600 "$HOME/.openclaw/credentials/binance.json" ``` 3. Validate ownership and permissions before reading the file, and reject files that are group- or world-readable. 4. Require least-privilege Binance keys: - Use read-only keys for market analysis and account inspection. - Enable trading permission only when order execution is required. - Disable withdrawal permission. - Apply an IP allowlist where operationally possible. - Use a separate key for this Skill rather than reusing a broadly privileged key. 5. Avoid logging credential values, signed request URLs, environment dumps, or configuration-file contents. 6. Document secure key rotation and immediate revocation procedures for suspected exposure. 7. Reconcile the documented environment variable names with the shell examples so users are not encouraged to copy secrets into additional locations while troubleshooting.