T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:149
- Finding
- API Key Exposed Through Command-Line Arguments and Plaintext Configuration## Vulnerability Details **File Location**: `SKILL.md`, lines 149–157 **Vulnerability Type**: Plaintext sensitive-data exposure **Risk Level**: Medium ```bash AGENT_ID="work-agent" IDX=$(openclaw agents list --bindings --json | jq -r --arg id "$AGENT_ID" 'to_entries[] | select(.value.id==$id) | .key') KEY=$(jq -r '.profiles["openrouter:default"].key' ~/.openclaw/agents/$AGENT_ID/agent/auth-profiles.json) openclaw config set "agents.list[$IDX].memorySearch.provider" '"openai"' --strict-json openclaw config set "agents.list[$IDX].memorySearch.model" '"text-embedding-3-small"' --strict-json openclaw config set "agents.list[$IDX].memorySearch.remote.baseUrl" '"https://openrouter.ai/api/v1"' --strict-json openclaw config set "agents.list[$IDX].memorySearch.remote.apiKey" "\"$KEY\"" --strict-json ``` ### Technical Analysis The workflow extracts an API key from `auth-profiles.json` into a shell variable and then expands the key directly into an `openclaw config set` command-line argument. During execution, the expanded secret may be exposed through local process inspection, shell tracing, terminal recording, command auditing, or diagnostic logs. The command also places the key into the general OpenClaw configuration. Because the workflow separately instructs users to create timestamped backups of `openclaw.json`, secret-bearing configuration may be copied into long-lived backup files. This increases the number of plaintext credential copies and complicates credential revocation and secure deletion. The finding conflicts with the Skill's own instruction not to echo secrets in plaintext. No hardcoded credential was found in the project itself; the weakness concerns the handling of a credential obtained from the user's local authentication profile. ### Attack Path 1. A victim follows the documented memory-provider configuration workflow. 2. The shell reads the OpenRouter API key from the agent's authentication profile. 3. Th ...[truncated 1172 chars]
- Remediation
- ## Remediation Suggestions - Use a provider-supported secret-store, keychain, credential-profile, or environment-variable reference instead of copying the API key into general configuration. - Avoid placing secret values in command-line arguments. Prefer protected standard input, a dedicated file descriptor, or an API that accepts secret references. - If plaintext storage is unavoidable, enforce owner-only permissions on the configuration and authentication files and verify the permissions after each update. - Disable shell tracing before reading the credential and ensure scripts do not print commands containing expanded secrets. - Exclude secret-bearing configuration from terminal recordings, command-audit output, support bundles, and ordinary backups. - If configuration backups must contain credentials, encrypt them, restrict their permissions, define a short retention period, and securely delete expired copies. - Use a narrowly scoped provider key with spending limits and monitoring where supported. - Document a credential-rotation procedure and instruct users to rotate any key that may have appeared in process records or historical backups. - Obtain explicit user approval before transmitting memory-derived content to the configured third-party embedding endpoint, and document that provider's retention and privacy implications.