T09 · Insecure Skill Coding Practices
Error
- Location
password_manager.py:12- Finding
Credentials Are Silently Stored in Plaintext When Encryption Is Unavailable
- Content
View full analysis
str: """加密密码""" if not ENCRYPTION_AVAILABLE: return password cipher = get_cipher() if cipher: return cipher.encrypt(password.encode()).decode() return password ``` ### Technical Analysis The application fails open when the `cryptography` dependency is unavailable. Instead of refusing to accept or persist credentials, `encrypt_password()` returns the original password unchanged. The caller then stores that value in `passwords.json` as though it were encrypted. A console warning is insufficient protection because users or automated agents may overlook it. This also contradicts the documented claim that passwords are encrypted at rest. The final `return password` creates an additional fail-open path if a cipher is unexpectedly unavailable. ### Attack Path 1. The application runs in an environment where `cryptography` is absent or cannot be imported. 2. `ENCRYPTION_AVAILABLE` is set to `False`. 3. A user or agent invokes the `add` or `import` command. 4. `encrypt_password()` returns the original credential without encryption. 5. `save_passwords()` writes the plaintext credential to `~/.openclaw/workspace/passwords.json`. 6. Any local user or process with read access to that file can recover the credential directly. ### Impact Assessment An attacker who can read the vault file can obtain every credential added while encryption was unavailable. The exposure includes passwords for all represented services and accounts and may consequently enab ...[truncated 146 chars]- Remediation
View remediation