T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/save_to_flomo.sh:24
- Finding
- Flomo Webhook Secret Disclosure Through Curl Debug Logging## Vulnerability Details **File Location**: `scripts/save_to_flomo.sh`, lines 24-25 and 33-39 **Vulnerability Type**: Sensitive URL disclosure through verbose diagnostic output **Risk Level**: Medium **Vulnerable Code**: ```bash if [[ "${FLOMO_DEBUG:-}" != "" ]]; then echo "[flomo-notes] payload_bytes=$(printf %s "$JSON_PAYLOAD" | wc -c | tr -d ' ')" >&2 echo "[flomo-notes] posting to FLOMO_WEBHOOK_URL (redacted)" >&2 fi curl -sS -X POST "$FLOMO_WEBHOOK_URL" \ -H "Content-type: application/json" \ -d "$JSON_PAYLOAD" \ ${FLOMO_DEBUG:+-v} \ >/dev/null ``` ### Technical Analysis `FLOMO_WEBHOOK_URL` contains a secret Flomo inbox token in its URL path. When `FLOMO_DEBUG` is nonempty, `${FLOMO_DEBUG:+-v}` enables curl's verbose mode. Although the preceding diagnostic message says that the URL is redacted, `curl -v` independently writes request diagnostics to standard error. These diagnostics can include the complete request URL, including the secret webhook path. Standard error is commonly collected by OpenClaw gateways, service managers, CI systems, containers, and centralized logging platforms. The issue does not require shell command injection. It occurs through the normal debug feature whenever the environment variable is enabled or inherited. ### Attack Path 1. A user, administrator, or execution environment sets `FLOMO_DEBUG` to any nonempty value. 2. The skill invokes `scripts/save_to_flomo.sh` with a configured `FLOMO_WEBHOOK_URL`. 3. The parameter expansion adds `-v` to the curl command. 4. Curl emits verbose request information to standard error. 5. The gateway, service, or CI logging system records that output. 6. An attacker or unauthorized operator with access to those logs obtains the webhook URL. 7. The attacker sends arbitrary POST requests to the exposed webhook and injects unauthorized content into the victim's Flomo inbox. ### Impact Assessment Exploitation does ...[truncated 553 chars]
- Remediation
- ## Remediation Suggestions 1. Remove `${FLOMO_DEBUG:+-v}` and never use curl verbose mode with a credential embedded in the URL. 2. Implement bounded diagnostics that do not print request URLs or headers. For example, capture only the HTTP status code with `--write-out '%{http_code}'`. 3. If endpoint diagnostics are necessary, log only a fixed service name such as `flomoapp.com`; do not log the webhook path, query string, or token. 4. Ensure error-handling paths also redact the URL before writing messages to standard error. 5. Treat existing debug logs as potentially compromised. Delete or restrict affected logs and rotate the Flomo webhook if verbose mode has previously been used. 6. Add an automated test that enables `FLOMO_DEBUG`, captures standard error, and verifies that neither the webhook token nor the complete URL appears in output.