T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:17
- Finding
- Credential-Handling Functionality Is Delegated to Missing and Unauditable Scripts## Vulnerability Details **File Location**: `SKILL.md:17-45` **Additional References**: `README.md:13-14`, `README.md:27-36`, `README.md:64-66` **Vulnerability Type**: Sensitive credential handling through missing executable components **Risk Level**: Medium ### Evidence ```markdown ### `claude-usage` Reads the Claude Code OAuth token from macOS Keychain and calls the Anthropic usage API. ```bash # Human-readable output with color bars scripts/claude-usage # JSON output (for programmatic use) scripts/claude-usage --json ``` **Requirements:** - macOS with `security` CLI (Keychain access) - Claude Code OAuth token in Keychain (run `claude login` to set up) - Token needs `user:profile` scope (standard Claude Code login provides this) **Token location:** macOS Keychain, service `Claude Code-credentials`, account = your macOS username. ### `openai-usage` Reads the OpenAI OAuth token from OpenClaw's auth-profiles and calls the ChatGPT usage API. ```bash # Human-readable output with color bars scripts/openai-usage # JSON output scripts/openai-usage --json ``` **Requirements:** - OpenClaw with an authenticated `openai-codex` profile (run `openclaw auth openai-codex`) - Auth profiles at `~/.openclaw/agents/main/agent/auth-profiles.json` ``` ### Technical Analysis The skill explicitly claims that `scripts/claude-usage` reads a Claude OAuth token from macOS Keychain and that `scripts/openai-usage` reads an OpenAI OAuth token from an OpenClaw authentication-profile file. However, the audited package contains only `README.md` and `SKILL.md`; neither referenced executable is present. Consequently, the security-critical implementation cannot be examined for: - Restriction of outbound requests to official Anthropic and OpenAI endpoints. - Safe construction of HTTP requests and command arguments. - Prevention of OAuth-token disclosure through standard output, error output, logs, or except ...[truncated 2774 chars]
- Remediation
- ## Remediation Suggestions 1. Include `scripts/claude-usage` and `scripts/openai-usage` in the same reviewed and versioned package, or remove all commands and claims referring to them. 2. Pin the scripts to a verifiable release and publish cryptographic checksums or signed release artifacts. 3. Restrict network requests to hard-coded, documented HTTPS origins operated by Anthropic and OpenAI. Reject redirects to other origins and retain TLS certificate verification. 4. Request and use only the minimum OAuth scopes required to retrieve usage information. 5. Never print, persist, cache, or include access tokens in command arguments, URLs, diagnostics, exception traces, or telemetry. 6. Read authentication files without modifying them, validate ownership and restrictive permissions, and avoid copying their contents into temporary files. 7. If temporary storage is unavoidable, use securely created user-only files and guarantee cleanup on normal and exceptional exits. 8. Add automated tests covering token redaction, endpoint allowlisting, redirect rejection, malformed authentication data, timeout behavior, and failure paths. 9. Update the installation documentation so users are not encouraged to obtain missing scripts from unofficial sources. 10. Ensure release validation fails when documentation references executable files that are absent from the packaged artifact.