other
Warning
- Location
scripts/scan_exposure.py:56- Finding
Broad Credential Reconnaissance Creates a High-Value Persistent Exposure Map
- Content
View full analysis
12 and bool(re.match(r'^[a-zA-Z0-9/+=_-]+$', value)) if is_secret_name and value: findings.append({ "source": "env_var", "location": key, "type": "environment_variable", "preview": value[:8] + "***" if len(value) > 8 else "***", "risk_score": 55, "risk_reason": "Accessible to all skills via exec", }) return findings ``` The same scan also reads configuration, environment files, persistent memory, MCP configuration, and Git history. All findings are then consolidated into a persistent report: ```python report = { "scan_time": datetime.now(timezone.utc).isoformat(), "workspace": WORKSPACE, "total_findings": len(deduped), "risk_distribution": { "critical": sum(1 for f in deduped if f.get("risk_score", 0) >= 70), "high": sum(1 for f in deduped if 50 <= f.get("risk_score", 0) < 70), "medium": sum(1 for f in deduped if 30 <= f.get("risk_score", 0) < 50), "low": sum(1 for f in deduped if f.get("risk_score", 0) < 30), }, "findings": deduped, } os.makedirs(OPENCLAW_DIR, exist_ok=True) with open(REPORT_PATH, 'w', encoding='utf-8') as f: json.dump(report, f, indent=2) os.chmod(REPORT_PATH, 0o600) ``` ### Technical Analysis The Skill systematically enumerates credential-related data across multiple sensitive domains: - Process environment variables - `~/.openclaw/openclaw.jso ...[truncated 2419 chars]- Remediation
View remediation