credential-exposure-map

• Outcome: Review
• Latest audit: Jul 30, 2026 · 8:15 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed local credential-audit tool, but it automatically scans sensitive credential sources and saves a persistent report without clear user opt-in or scan scoping.

Install only if you intentionally want a broad local credential exposure audit. Run it in a trusted environment, review or delete ~/.openclaw/credential-exposure-report.json after use, and be aware it inspects environment variables, OpenClaw config, .env files, memory files, installed skills, MCP server config, and recent git history.

SkillSpector

By NVIDIA

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger

Findings (23)

Lp3

Medium

• Category: MCP Least Privilege
• Confidence: 91% confidence
• Finding: The skill invokes a Python scanner that reads environment variables, config files, memory files, git history, and writes a report, yet the skill declares no explicit permissions. This creates a capability/permission mismatch that can cause users or policy systems to underestimate the skill's access to sensitive data, increasing the chance of unintended credential exposure.

Description-Behavior Mismatch

Low

• Confidence: 94% confidence
• Finding: The skill persists a credential exposure report to disk, creating a new sensitive artifact that inventories secret locations and partial previews. Even with mode 0600, this increases exposure because any later process with the same user access can read a consolidated map of high-value credential sources.

Context-Inappropriate Capability

Medium

• Confidence: 89% confidence
• Finding: The skill claims credential discovery but also inventories other installed skills and infers their exec, network, and write capabilities. That expands scope into broader reconnaissance, which can help an attacker identify the best lateral path for secret access or exfiltration.

Missing User Warnings

Medium

• Confidence: 90% confidence
• Finding: The README explicitly advertises scanning highly sensitive sources such as environment variables, memory files, config, and git history, and also states that a report is saved to a persistent file. Even if values are masked in output, collecting and persisting credential metadata increases the attack surface and privacy risk unless users are clearly warned, given opt-in controls, and told how the report is protected and cleaned up.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The README describes broad scanning of highly sensitive sources including environment variables, config files, memory, MCP connections, and Git history, but the introductory description does not clearly warn users that invoking the skill will inspect secrets and persist a report to disk. This creates a meaningful consent and transparency failure: users may trigger a credential-harvesting workflow without understanding the scope of access or the artifact being written.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The usage examples encourage simple natural-language triggers such as 'credential audit' and 'exposure map' without a prominent warning that the action will enumerate credentials from sensitive locations and inspect recent Git history. Because the skill is designed to inventory secrets accessible to the agent, omission of this warning increases the chance of unintentional disclosure and normalizes broad secret access behind an innocuous command.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrase "what can my agent access" is broader than the skill's stated credential-exposure purpose and may match general capability questions. In this context, that ambiguity is dangerous because activation leads to scanning sensitive stores like env, memory, config, and git history.

Vague Triggers

Medium

• Confidence: 84% confidence
• Finding: The trigger phrase "what can my agent access" is broader than the skill's stated credential-exposure purpose and may match general capability questions. In this context, that ambiguity is dangerous because activation leads to scanning sensitive stores like env, memory, config, and git history.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill does not clearly warn users up front that running it inspects sensitive sources including environment variables, memory files, configuration, MCP auth, and git history, and also writes a report to disk. Lack of informed consent is especially risky here because the scan aggregates secrets metadata into a persisted artifact that could itself become a target for disclosure.

Missing User Warnings

Medium

• Confidence: 96% confidence
• Finding: Writing a credential exposure report to disk without warning or confirmation can surprise users and leave behind a durable catalog of sensitive locations. This is especially risky because the report aggregates multiple secret sources into one easy-to-read file, reducing attacker effort if the account is later compromised.

MCP Config Access

High

• Category: Agent Snooping

Content

def scan_mcp_servers():
    """List MCP servers from config."""
    findings = []
    if not os.path.exists(CONFIG_PATH):
        return findings

• Confidence: 93% confidence
• Finding: List MCP servers

Env Variable Harvesting

High

• Category: Data Exfiltration

Content

def scan_env_vars():
    """Scan process.env for credential-like variables."""
    findings = []
    for key, value in os.environ.items():
        key_upper = key.upper()
        is_secret_name = any(s in key_upper for s in ENV_SECRET_NAMES)
        looks_like_secret = len(value) > 12 and bool(re.match(r'^[a-zA-Z0-9/+=_-]+$', value))

• Confidence: 98% confidence
• Finding: for key, value in os.environ.items()

File System Enumeration

Medium

• Category: Data Exfiltration

Content

os.path.join(WORKSPACE, ".env.local"),
        os.path.join(OPENCLAW_DIR, ".env"),
    ]
    search_paths += glob.glob(os.path.join(WORKSPACE, ".env*"))
    
    seen = set()
    for path in search_paths:

• Confidence: 95% confidence
• Finding: glob.glob(os.path.join(WORKSPACE, ".env

File System Enumeration

Medium

• Category: Data Exfiltration

Content

def scan_env_files():
    """Scan .env files for credentials."""
    findings = []
    search_paths = [
        os.path.join(WORKSPACE, ".env"),

• Confidence: 94% confidence
• Finding: Scan .env files

Credential Access

High

• Category: Privilege Escalation

Content

### Features

- **8 scan sources**: env vars, config, .env files, memory (MD + JSON), skills, MCP servers, git history
- **16 secret patterns**: AWS, GitHub, OpenAI, Anthropic, Stripe, Slack, Google, JWT, PostgreSQL, Redis, generic keys
- **Risk scoring**: 0-100 per credential based on accessibility, persistence, and exposure paths
- **Skill capability matrix**: Shows which skills have exec, read, network, write access

• Confidence: 97% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

扫描开始
├── 环境变量 → 模式匹配密钥/令牌/密码
├── openclaw.json → 解析 JSON，查找凭据字段
├── .env 文件 → 搜索 KEY/TOKEN/SECRET/PASS 模式
├── MEMORY.md + memory/*.md → 正则扫描已提交的凭据
├── memory/*.json → 解析 JSON 查找凭据值
├── skills/*/SKILL.md → 能力分析（执行/读取/网络/写入）

• Confidence: 97% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

### 功能

- **8 种扫描来源**：环境变量、配置、.env 文件、记忆文件（MD + JSON）、Skill、MCP 服务器、Git 历史
- **16 种密钥模式**：AWS、GitHub、OpenAI、Anthropic、Stripe、Slack、Google、JWT、PostgreSQL、Redis、通用密钥
- **风险评分**：基于可访问性、持久性和暴露路径，每个凭据 0-100 分
- **Skill 能力矩阵**：显示每个 Skill 的执行/读取/网络/写入权限

• Confidence: 96% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

# ── Scanners ─────────────────────────────────────────────────────────────────

def scan_env_vars():
    """Scan process.env for credential-like variables."""
    findings = []
    for key, value in os.environ.items():
        key_upper = key.upper()

• Confidence: 97% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

def scan_env_files():
    """Scan .env files for credentials."""
    findings = []
    search_paths = [
        os.path.join(WORKSPACE, ".env"),

• Confidence: 96% confidence
• Finding: .env

Credential Access

High

• Category: Privilege Escalation

Content

"""Scan .env files for credentials."""
    findings = []
    search_paths = [
        os.path.join(WORKSPACE, ".env"),
        os.path.join(WORKSPACE, ".env.local"),
        os.path.join(OPENCLAW_DIR, ".env"),
    ]

• Confidence: 95% confidence
• Finding: .env"

Credential Access

High

• Category: Privilege Escalation

Content

findings = []
    search_paths = [
        os.path.join(WORKSPACE, ".env"),
        os.path.join(WORKSPACE, ".env.local"),
        os.path.join(OPENCLAW_DIR, ".env"),
    ]
    search_paths += glob.glob(os.path.join(WORKSPACE, ".env*"))

• Confidence: 95% confidence
• Finding: .env.local"

Credential Access

High

• Category: Privilege Escalation

Content

search_paths = [
        os.path.join(WORKSPACE, ".env"),
        os.path.join(WORKSPACE, ".env.local"),
        os.path.join(OPENCLAW_DIR, ".env"),
    ]
    search_paths += glob.glob(os.path.join(WORKSPACE, ".env*"))

• Confidence: 96% confidence
• Finding: .env"

Session Persistence

Medium

• Category: Rogue Agent

Content

### Skill Capability Matrix

Table showing each installed skill with exec/read/network/write permissions and risk score.

## Security Considerations

• Confidence: 90% confidence
• Finding: write permissions and risk score. ## Security Considerations - NEVER output full credential values. Always mask as `first8chars***` - Report is saved to `~/.openclaw

VirusTotal

VirusTotal findings are pending for this skill version.

Static analysis

No suspicious patterns detected.