T09 · Insecure Skill Coding Practices
- Location
SKILL.md:58- Finding
Overbroad Git Staging May Persist Sensitive Agent Data
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 58–64
Vulnerability Type: Overbroad staging of potentially sensitive files
Risk Level: MediumVulnerable Code
bash cd ~/.openclaw # Check current status git status # Add all tracked files (respecting .gitignore) git add -A # Create commit with descriptive message git commit -m "checkpoint: {description of pending change}"The associated denylist at lines 143–172 only excludes selected sensitive file names and formats:
gitignore # Session logs (volatile) *.jsonl *.jsonl.lock *.jsonl.reset.* # Databases (volatile) *.sqlite *.sqlite-journal # Credentials (sensitive) credentials/ *.pem *.key # Temporary files *.tmp *.temp .DS_Store # Logs logs/ # Delivery queue delivery-queue/Technical Analysis
The skill directs the agent to execute
git add -Ain~/.openclaw. This stages every new, modified, and deleted file within the repository unless a matching ignore rule applies. The proposed.gitignoreis a denylist and excludes only a limited set of credential formats and directories.It does not account for common sensitive artifacts such as
.envfiles, token files, cloud-provider credentials, authentication configuration, or secrets embedded inopenclaw.json, memory files, and other configuration documents. Moreover,.gitignoredoes not protect sensitive files that Git already tracks.Once sensitive content is committed, deleting it in a later commit does not remove it from prior Git history. The content can remain recoverable through ordinary Git commands and may be disclosed if the repository is copied, backed up, shared, or connected to a remote.
Attack Path
- A credential, token, private user information, or another secret is written to an unignored file under
~/.openclaw. - The user requests a checkpoint, or the agent creates one before a sensitive operation ...[truncated 1277 chars]
- A credential, token, private user information, or another secret is written to an unignored file under
- Remediation
View remediation
Remediation Suggestions
- Replace
git add -Awith an explicit allowlist of files intended for each checkpoint, such as:bash git add -- workspace/SOUL.md workspace/AGENTS.md - Require inspection of the staged patch before every commit:
bash git diff --cached --stat git diff --cached - Add a secret-scanning step and abort the commit when credentials, private keys, tokens, or high-entropy secrets are detected.
- Expand ignore rules to cover environment files, token stores, cloud credentials, authentication configuration, backups, and other project-specific sensitive artifacts.
- Verify whether sensitive files are already tracked with
git ls-files;.gitignorealone does not protect tracked files. Remove such files from the index and purge existing secrets from history where necessary. - Exclude memory and general configuration files by default unless their contents have been reviewed and are known not to contain secrets or private information.
- Verify the repository root with
git rev-parse --show-toplevelbefore staging so that the command cannot unintentionally operate over a broader repository. - Prevent accidental publication by confirming that no unauthorized Git remote is configured and by applying restrictive filesystem permissions to the local repository.
- Replace