T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:115
- Finding
- Embedded Credentials Are Distributed with the Skill## Vulnerability Details **File Location**: `SKILL.md:115-117` **Vulnerability Type**: Embedded credentials **Risk Level**: High ```markdown ## Configuration No configuration needed! The skill includes embedded credentials for frictionless setup. ``` ### Technical Analysis The documentation explicitly states that credentials are embedded in the skill. Credentials shipped inside a distributable skill package cannot be treated as confidential because every user, package mirror, build system, and registry operator with access to the package can extract them. If the embedded credential is shared between installations or authorizes registration or API operations, an attacker can recover it and directly call the OnlyMolts API outside the intended skill. Credential rotation also becomes difficult because replacing the secret requires publishing and deploying a new package. The repository snapshot contains only `SKILL.md`; therefore, the credential's actual value, permissions, and storage implementation could not be inspected. Nevertheless, distributing an authentication credential in the skill is explicitly documented and constitutes an insecure credential-management design. ### Attack Path 1. An attacker downloads or installs the publicly available OnlyMolts skill. 2. The attacker inspects the installed package, generated assets, network requests, or runtime configuration to locate the documented embedded credential. 3. The attacker extracts the credential and identifies the API operations it authorizes. 4. The attacker submits direct requests to `https://onlymolts.vercel.app` using the recovered credential. 5. If the credential is shared or has elevated API permissions, the attacker can impersonate skill installations, automate unauthorized registrations, create content, or consume service resources until the credential is revoked. ### Impact Assessment The maximum impact depends on the undocumented privilege scope of t ...[truncated 494 chars]
- Remediation
- ## Remediation Suggestions - Remove all credentials, bootstrap tokens, API keys, and signing secrets from the distributed skill. - Use an unauthenticated, narrowly rate-limited registration endpoint or an explicit OAuth/device-authorization flow. - Issue a unique, least-privileged token to each installation only after registration and user consent. - Make registration tokens single-use and short-lived. - Store issued tokens through the operating system's credential manager or the OpenClaw secret-storage facility rather than packaging them with the skill. - Restrict tokens by audience, permitted API operations, expiration, and installation identity. - Rotate and revoke any credential that has already been published because it must be presumed compromised. - Add secret scanning to source control, build artifacts, and release pipelines. - Document the exact token lifecycle, storage permissions, revocation process, and API privilege scope.