T09 · Insecure Skill Coding Practices
Error
- Location
- test_models.py:14
- Finding
- Cross-Provider API Credential Disclosure<![CDATA[ ## Vulnerability Details **File Location**: `test_models.py`, lines 14–28 and 41–55 **Vulnerability Type**: Cross-provider credential disclosure **Risk Level**: High ### Vulnerable Code ```python def test_model(model_id, token, timeout=30): """Test if a model is available. Returns (success, error_msg).""" cmd = [ "curl", "-s", "-m", str(timeout), "-X", "POST", "https://openrouter.ai/api/v1/chat/completions", "-H", f"Authorization: Bearer {token}", "-H", "Content-Type: application/json", "-d", json.dumps({ "model": model_id, "messages": [{"role": "user", "content": "test"}], "max_tokens": 5 }) ] result = subprocess.run(cmd, capture_output=True, text=True) ``` ```python # Try ANTHROPIC_AUTH_TOKEN first (for Claude Code compatibility) token = os.environ.get('ANTHROPIC_AUTH_TOKEN', '').strip() # If not set, try OPENROUTER_API_KEY (for OpenRouter) if not token: token = os.environ.get('OPENROUTER_API_KEY', '').strip() # If still not set, try reading from OpenClaw config if not token: try: with open(Path.home() / '.openclaw' / 'openclaw.json') as f: cfg = json.load(f) token = cfg.get('models', {}).get('providers', {}).get('openrouter', {}).get('apiKey', '').strip() except Exception: pass ``` ### Technical Analysis The script prioritizes `ANTHROPIC_AUTH_TOKEN` over `OPENROUTER_API_KEY` and then unconditionally sends the selected value to the OpenRouter chat-completions endpoint as a bearer credential. Environment-variable names normally establish a provider trust boundary. A genuine Anthropic credential stored in `ANTHROPIC_AUTH_TOKEN` is not necessarily intended for disclosure to OpenRouter. Treating it as an OpenRouter credential can therefore transmit a secret to a different service without an explicit provider check or informed user opt-in. The a ...[truncated 1917 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove support for `ANTHROPIC_AUTH_TOKEN` from requests sent to OpenRouter. 2. Accept only an explicitly OpenRouter-scoped source: - `OPENROUTER_API_KEY`; or - `models.providers.openrouter.apiKey` from the OpenClaw configuration. 3. Prefer `OPENROUTER_API_KEY` over configuration-file fallback to reduce unnecessary access to persistent secrets. 4. If compatibility mode is essential, require an explicit command-line option such as `--use-anthropic-auth-token-for-openrouter` and display the destination before sending the value. 5. Update `README.md`, `SKILL.md`, and related installation instructions so they do not encourage cross-provider credential reuse. 6. Avoid placing the authorization header in a command-line argument. Use a native HTTPS client or otherwise pass secrets through a mechanism that does not expose them in the spawned process's argument list. 7. Add tests confirming that a populated `ANTHROPIC_AUTH_TOKEN` is never transmitted to OpenRouter by default. ]]>