T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/sync.py:24- Finding
Sensitive authentication credentials are stored in plaintext without enforced access restrictions
- Content
View full analysis
{DATA_DIR}/config.json') ``` ```python print(' python3 -c "import json; json.dump({\"mode\":\"broker\",\"broker\":\"htf\",\"token\":\"xxx\"},open(\"~/.openclaw/sim_trade/config.json\",\"w\"))"') ``` ### Technical Analysis The Skill stores authenticated session cookies and broker API tokens directly in `~/.openclaw/sim_trade/config.json`. The file is created with Python's default `open()` behavior, so its effective permissions depend on the process umask. The code does not enforce a mode such as `0600`, verify ownership, reject symbolic links, or use an operating-system credential store. The documented shell commands also embed credentials directly in command text. If users substitute real credentials, those values may remain in shell history or be exposed through process inspection while the command is running. Although the current synchronization functions are stubs and do not transmit the credentials, the credentials remain independently usable against the associated services. Their local storage therefore creates a credential-disclosure risk. ### Attack Path 1. A user follows the Skill documentation and configures an Eastmoney or Tonghuashun session cookie, or a broker API token. 2. The credential is ...[truncated 1228 chars]- Remediation
View remediation