T05 · Unauthorized Access and Privilege Escalation
Warning
- Location
SKILL.md:45- Finding
Sensitive Configuration and Credential Reconnaissance May Expose Secrets to Agent Context
- Content
View full analysis
/dev/null find ~/.openclaw/workspace -name "*.json" | xargs grep -l "sk_live\|rk_live\|ghp_\|re_" 2>/dev/null ``` ```bash find ~/.openclaw/workspace -name "*.json" -o -name "*.env" | \ xargs grep -l "sk_\|rk_\|ghp_\|re_\|Bearer" 2>/dev/null ``` ### Technical Analysis The Skill instructs the agent to inspect OpenClaw configuration and systematically enumerate files likely to contain credentials. Credential discovery is relevant to the declared security-audit functionality, but the implementation does not consistently enforce least privilege or redact sensitive output. In particular, the gateway-token command prints matching configuration lines rather than reporting only whether a token exists, whether it is empty, or whether its length is adequate. Depending on the configuration format, the actual gateway token may consequently be placed in terminal output, agent context, execution transcripts, or retained logs. The broader file scans return the locations of likely secret-bearing files. Although the `grep -l` operations do not print the matched secret values, they create a useful credential inventory that becomes available to any later compromised agent instruction or untrusted content in the same session. The `find` expressions also lack grouping around their `-o` conditions. While this does not directly expose additional file contents in the shown commands, explicit grouping would make the intended scope clearer and less error-prone. ### Attack Path 1. A user loads the Skill and authorizes the credential-protection audit. 2. The agent executes the gateway-token grep command ...[truncated 1476 chars]- Remediation
View remediation
/dev/null ``` 7. Prevent command output containing secrets from being copied into persistent memory or ordinary application logs. 8. Prefer a dedicated secret scanner that redacts matches and supports allowlists. ]]>