T09 · Insecure Skill Coding Practices
Warning
- Location
- index.js:43
- Finding
- Camera Access Tokens May Be Stored in a Plaintext Configuration File## Vulnerability Details **File Location**: `index.js:43-52` **Supporting Documentation**: `SKILL.md:77-81` **Vulnerability Type**: Plaintext storage of sensitive camera credentials **Risk Level**: Medium The documented setup workflow collects a camera API access token and other device parameters. The implementation reads and writes the resulting configuration as unprotected JSON in the skill installation directory. ```js async loadOrCreateConfig() { const configPath = path.join(this.skillDir, 'config.json'); if (fs.existsSync(configPath)) { console.log('✅ Loading existing configuration...'); this.config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } else { console.log('📝 No configuration found. Let\'s set it up!'); await this.promptForConfig(); // Save config for future use fs.writeFileSync(configPath, JSON.stringify(this.config, null, 2)); ``` The corresponding configuration structure explicitly contains the sensitive field: ```js camera: { url: '', // Will be filled by OpenClaw context accessToken: '', // Will be filled by OpenClaw context deviceSerial: '', // Will be filled by user input channelNo: '1', // Default projectId: 'intelligent-inspection' // Default }, ``` ### Technical Analysis `fs.writeFileSync()` is called without an explicit restrictive file mode, encryption, secret-manager integration, or subsequent ownership and permission validation. Consequently, any camera access token populated into `this.config` may be persisted as plaintext under the process's default umask and ambient filesystem permissions. The file is stored at `path.join(this.skillDir, 'config.json')`, next to the executable skill code. This also conflicts with the documented isolated workspace path in `SKILL.md:81`, increasing the possibility that credentials could be included in a copied, archived, back ...[truncated 1566 chars]
- Remediation
- ## Remediation Suggestions 1. Store camera access tokens in the OpenClaw secret-management facility or an operating-system credential store rather than in general JSON configuration. 2. Keep only a secret reference or identifier in `config.json`. 3. If file-based secret storage is unavoidable, create the file atomically with mode `0600`, for example: ```js fs.writeFileSync(configPath, JSON.stringify(this.config, null, 2), { encoding: 'utf8', mode: 0o600, flag: 'wx' }); ``` 4. Verify file ownership and reject files readable or writable by unauthorized users before loading credentials. 5. Store runtime configuration in the single documented workspace location outside the distributable skill directory. 6. Separate sensitive credentials from non-sensitive settings to reduce exposure through backups, diagnostics, and configuration sharing. 7. Add `config.json` to package and version-control exclusion rules. 8. Support token rotation and revoke any token known to have been stored in or distributed with an exposed configuration file.