credential-exposure-map

• Outcome: Review
• Latest audit: Jul 31, 2026 · 6:25 PM UTC
• Version: 1.0.2

Overview

The skill is a credential-audit tool, but it needs Review because it broadly scans sensitive local sources and automatically saves a credential exposure report.

Install only if you intentionally want a broad credential exposure audit. Review the hard-coded workspace path, expect it to inspect OpenClaw home files and git history, and delete or protect the saved report after use.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (21)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 95% confidence
• Finding: The skill is designed to enumerate highly sensitive data sources such as environment variables, memory files, config, and git history, and it invokes a shell command to do so, yet it declares no permissions. That mismatch is dangerous because it conceals the true capability footprint from users and policy systems, reducing informed consent and increasing the chance the skill is activated with broader access than expected.

Description-Behavior Mismatch

Medium

• Confidence: 86% confidence
• Finding: The skill advertises credential exposure mapping, but it also inventories all installed skills and infers exec/network/write capabilities. That broadens collection beyond the stated purpose and can reveal the agent's security posture and attack surface to anyone invoking the skill.

Description-Behavior Mismatch

Low

• Confidence: 88% confidence
• Finding: The code persists a detailed credential-exposure report to disk even though the skill description frames this as a scan/report action, not durable storage. Persisting findings increases the lifetime and discoverability of sensitive metadata about secrets and locations.

Context-Inappropriate Capability

Medium

• Confidence: 83% confidence
• Finding: Using subprocess to inspect git history gives the skill command-execution behavior and access to repository history that goes beyond a minimal credential audit. In this context, the danger is expansion of inspection scope into historical data that may contain sensitive material the user did not expect to be parsed.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The phrase "what can my agent access" is ambiguous and may refer to general capabilities rather than a credential-focused forensic scan. In this skill's context, ambiguity is risky because activation would inspect secrets-bearing locations and generate an on-disk report without the user necessarily asking for credential enumeration specifically.

Vague Triggers

Medium

• Confidence: 92% confidence
• Finding: The phrase "what can my agent access" is ambiguous and may refer to general capabilities rather than a credential-focused forensic scan. In this skill's context, ambiguity is risky because activation would inspect secrets-bearing locations and generate an on-disk report without the user necessarily asking for credential enumeration specifically.

Missing User Warnings

Medium

• Confidence: 94% confidence
• Finding: The skill description and flow do not clearly warn users up front that it will inspect multiple sensitive sources and persist results to disk. This is dangerous because users may invoke it based on a generic audit request without understanding the scope of credential collection, retention, and potential secondary exposure from the saved report.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The report written to ~/.openclaw contains a consolidated map of credential locations, previews, MCP auth presence, skill capabilities, and repository history hits. Even with 0600 permissions, creating a durable high-value index of secrets increases exposure if the account, backups, logs, or later tooling accesses that file.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: The skill enumerates environment variables and parses the OpenClaw config for credential-like values without any explicit runtime warning or consent flow. In a credential-audit context some inspection is expected, but scanning process environment and agent config is highly sensitive and should be clearly disclosed because it exposes secrets accessible to the agent.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The code recursively scans .env files, memory markdown, and memory JSON for secrets, which can include private notes, user data, and persisted credentials. This is more dangerous in this skill because it centralizes highly sensitive content from multiple stores without any explicit user-facing warning about the breadth of inspection.

Missing User Warnings

Low

• Confidence: 87% confidence
• Finding: Git history analysis can surface secrets that were removed from the working tree and may expose sensitive historical content from many commits. Because historical inspection is less obvious than scanning current files, failing to warn the user materially increases the privacy and surprise risk.

MCP Config Access

High

• Category: Agent Snooping

Content

def scan_mcp_servers():
    """List MCP servers from config."""
    findings = []
    if not os.path.exists(CONFIG_PATH):
        return findings

• Confidence: 91% confidence
• Finding: Reading MCP server configuration reveals what external systems the agent can reach and whether auth-related environment mappings are present. In the context of a credential audit this is adjacent, but it still exposes integration topology and auth metadata that can aid lateral movement or targeting if misused.

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def scan_env_vars():
    """Scan process.env for credential-like variables."""
    findings = []
    for key, value in os.environ.items():
        key_upper = key.upper()
        is_secret_name = any(s in key_upper for s in ENV_SECRET_NAMES)
        looks_like_secret = len(value) > 12 and bool(re.match(r'^[a-zA-Z0-9/+=_-]+$', value))

• Confidence: 98% confidence
• Finding: This code harvests all environment variables and extracts those whose names suggest secrets, then records their presence and previews. Even if intended for auditing, environment variables often contain production credentials, so broad enumeration materially increases the chance of disclosure through output, persistence, or later compromise of the generated report.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

os.path.join(WORKSPACE, ".env.local"),
        os.path.join(OPENCLAW_DIR, ".env"),
    ]
    search_paths += glob.glob(os.path.join(WORKSPACE, ".env*"))
    
    seen = set()
    for path in search_paths:

• Confidence: 90% confidence
• Finding: Wildcard enumeration of .env* files broadens collection to any matching secrets file in the workspace, including files the user may not realize are in scope. In a credential-audit skill this behavior is related to purpose, but the breadth still creates unnecessary over-collection risk if not clearly constrained.

File System Enumeration

Medium

• Category: Data Exfiltration

Content

def scan_env_files():
    """Scan .env files for credentials."""
    findings = []
    search_paths = [
        os.path.join(WORKSPACE, ".env"),

• Confidence: 83% confidence
• Finding: The .env-file scanning functionality intentionally enumerates common secret-bearing files in the workspace and OpenClaw directory. While aligned with the skill's purpose, it remains sensitive filesystem enumeration because it targets high-value credential stores and can expose more than the user expects.

Credential Access

High

• Category: Privilege Escalation

Content

# ── Scanners ─────────────────────────────────────────────────────────────────

def scan_env_vars():
    """Scan process.env for credential-like variables."""
    findings = []
    for key, value in os.environ.items():
        key_upper = key.upper()

• Confidence: 98% confidence
• Finding: This scanner is explicitly designed to access credentials from process environment data, which is a high-sensitivity source. The danger is amplified because the skill aggregates secret presence across many sources and later writes a durable report, making credential discovery easier for any actor who can invoke or access the report.

Credential Access

High

• Category: Privilege Escalation

Content

def scan_env_files():
    """Scan .env files for credentials."""
    findings = []
    search_paths = [
        os.path.join(WORKSPACE, ".env"),

• Confidence: 97% confidence
• Finding: Scanning .env files is direct credential access because those files commonly contain API keys, passwords, and tokens in plaintext. In this skill context that may be functionally intended, but it is still a genuine sensitive-data access path that requires strong notice, minimization, and output controls.

Credential Access

High

• Category: Privilege Escalation

Content

"""Scan .env files for credentials."""
    findings = []
    search_paths = [
        os.path.join(WORKSPACE, ".env"),
        os.path.join(WORKSPACE, ".env.local"),
        os.path.join(OPENCLAW_DIR, ".env"),
    ]

• Confidence: 97% confidence
• Finding: Targeting WORKSPACE/.env specifically is a high-confidence credential access behavior because such files often hold application secrets. The risk is not that the path is user-controlled, but that the skill normalizes reading plaintext secrets as part of routine execution.

Credential Access

High

• Category: Privilege Escalation

Content

findings = []
    search_paths = [
        os.path.join(WORKSPACE, ".env"),
        os.path.join(WORKSPACE, ".env.local"),
        os.path.join(OPENCLAW_DIR, ".env"),
    ]
    search_paths += glob.glob(os.path.join(WORKSPACE, ".env*"))

• Confidence: 97% confidence
• Finding: Targeting WORKSPACE/.env.local is similarly direct access to likely plaintext secrets, often including developer-only or environment-specific credentials. Because these local files may contain especially sensitive tokens not present elsewhere, scanning them raises the exposure level further.

Credential Access

High

• Category: Privilege Escalation

Content

search_paths = [
        os.path.join(WORKSPACE, ".env"),
        os.path.join(WORKSPACE, ".env.local"),
        os.path.join(OPENCLAW_DIR, ".env"),
    ]
    search_paths += glob.glob(os.path.join(WORKSPACE, ".env*"))

• Confidence: 97% confidence
• Finding: Scanning ~/.openclaw/.env accesses agent-local secret material outside the workspace, expanding beyond project credentials into platform or agent credentials. That broader scope makes the skill more dangerous because it inventories both application and agent-level secrets in one place.

Session Persistence

Medium

• Category: Rogue Agent

Content

### Skill Capability Matrix

Table showing each installed skill with exec/read/network/write permissions and risk score.

## Security Considerations

• Confidence: 93% confidence
• Finding: Saving a credential exposure report to disk creates a new persistent artifact containing a map of sensitive secrets and their locations, even if values are masked. That persistence increases the attack surface because local compromise, backup leakage, or later overbroad reads can reveal which credentials exist, where they live, and their relative value.

Static analysis

No suspicious patterns detected.