T09 · Insecure Skill Coding Practices
- Location
index.js:43- Finding
Camera Access Tokens May Be Stored in a Plaintext Configuration File
- Content
View full analysis
Vulnerability Details
File Location:
index.js:43-52
Supporting Documentation:SKILL.md:77-81
Vulnerability Type: Plaintext storage of sensitive camera credentials
Risk Level: MediumThe documented setup workflow collects a camera API access token and other device parameters. The implementation reads and writes the resulting configuration as unprotected JSON in the skill installation directory.
js async loadOrCreateConfig() { const configPath = path.join(this.skillDir, 'config.json'); if (fs.existsSync(configPath)) { console.log('✅ Loading existing configuration...'); this.config = JSON.parse(fs.readFileSync(configPath, 'utf8')); } else { console.log('📝 No configuration found. Let\'s set it up!'); await this.promptForConfig(); // Save config for future use fs.writeFileSync(configPath, JSON.stringify(this.config, null, 2));The corresponding configuration structure explicitly contains the sensitive field:
js camera: { url: '', // Will be filled by OpenClaw context accessToken: '', // Will be filled by OpenClaw context deviceSerial: '', // Will be filled by user input channelNo: '1', // Default projectId: 'intelligent-inspection' // Default },Technical Analysis
fs.writeFileSync()is called without an explicit restrictive file mode, encryption, secret-manager integration, or subsequent ownership and permission validation. Consequently, any camera access token populated intothis.configmay be persisted as plaintext under the process's default umask and ambient filesystem permissions.The file is stored at
path.join(this.skillDir, 'config.json'), next to the executable skill code. This also conflicts with the documented isolated workspace path inSKILL.md:81, increasing the possibility that credentials could be included in a copied, archived, back ...[truncated 1566 chars]- Remediation
View remediation
Remediation Suggestions
-
Store camera access tokens in the OpenClaw secret-management facility or an operating-system credential store rather than in general JSON configuration.
-
Keep only a secret reference or identifier in
config.json. -
If file-based secret storage is unavoidable, create the file atomically with mode
0600, for example:js fs.writeFileSync(configPath, JSON.stringify(this.config, null, 2), { encoding: 'utf8', mode: 0o600, flag: 'wx' }); -
Verify file ownership and reject files readable or writable by unauthorized users before loading credentials.
-
Store runtime configuration in the single documented workspace location outside the distributable skill directory.
-
Separate sensitive credentials from non-sensitive settings to reduce exposure through backups, diagnostics, and configuration sharing.
-
Add
config.jsonto package and version-control exclusion rules. -
Support token rotation and revoke any token known to have been stored in or distributed with an exposed configuration file.
-