T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:58
- Finding
- Overbroad Git Staging May Persist Sensitive Agent Data## Vulnerability Details **File Location**: `SKILL.md`, lines 58–64 **Vulnerability Type**: Overbroad staging of potentially sensitive files **Risk Level**: Medium ### Vulnerable Code ```bash cd ~/.openclaw # Check current status git status # Add all tracked files (respecting .gitignore) git add -A # Create commit with descriptive message git commit -m "checkpoint: {description of pending change}" ``` The associated denylist at lines 143–172 only excludes selected sensitive file names and formats: ```gitignore # Session logs (volatile) *.jsonl *.jsonl.lock *.jsonl.reset.* # Databases (volatile) *.sqlite *.sqlite-journal # Credentials (sensitive) credentials/ *.pem *.key # Temporary files *.tmp *.temp .DS_Store # Logs logs/ # Delivery queue delivery-queue/ ``` ### Technical Analysis The skill directs the agent to execute `git add -A` in `~/.openclaw`. This stages every new, modified, and deleted file within the repository unless a matching ignore rule applies. The proposed `.gitignore` is a denylist and excludes only a limited set of credential formats and directories. It does not account for common sensitive artifacts such as `.env` files, token files, cloud-provider credentials, authentication configuration, or secrets embedded in `openclaw.json`, memory files, and other configuration documents. Moreover, `.gitignore` does not protect sensitive files that Git already tracks. Once sensitive content is committed, deleting it in a later commit does not remove it from prior Git history. The content can remain recoverable through ordinary Git commands and may be disclosed if the repository is copied, backed up, shared, or connected to a remote. ### Attack Path 1. A credential, token, private user information, or another secret is written to an unignored file under `~/.openclaw`. 2. The user requests a checkpoint, or the agent creates one before a sensitive operation ...[truncated 1277 chars]
- Remediation
- ## Remediation Suggestions 1. Replace `git add -A` with an explicit allowlist of files intended for each checkpoint, such as: ```bash git add -- workspace/SOUL.md workspace/AGENTS.md ``` 2. Require inspection of the staged patch before every commit: ```bash git diff --cached --stat git diff --cached ``` 3. Add a secret-scanning step and abort the commit when credentials, private keys, tokens, or high-entropy secrets are detected. 4. Expand ignore rules to cover environment files, token stores, cloud credentials, authentication configuration, backups, and other project-specific sensitive artifacts. 5. Verify whether sensitive files are already tracked with `git ls-files`; `.gitignore` alone does not protect tracked files. Remove such files from the index and purge existing secrets from history where necessary. 6. Exclude memory and general configuration files by default unless their contents have been reviewed and are known not to contain secrets or private information. 7. Verify the repository root with `git rev-parse --show-toplevel` before staging so that the command cannot unintentionally operate over a broader repository. 8. Prevent accidental publication by confirming that no unauthorized Git remote is configured and by applying restrictive filesystem permissions to the local repository.