T09 · Insecure Skill Coding Practices
Error
- Location
bin/devops-platform-enhanced.js:21- Finding
Bearer Token Stored in a Plaintext Configuration File Without Enforced Permissions
- Content
View full analysis
- Remediation
View remediation
Security audit
Devops Platform Skill
Security checks for vulnerabilities and agentic risk
Overview
This appears to be a legitimate DevOps CLI skill, but it handles API tokens in ways that could expose them.
Install only if you trust the publisher and can control the configured API host. Do not paste real tokens into shared shells or chat prompts; prefer short-lived or least-privilege tokens, use HTTPS-only approved endpoints, protect or remove ~/.devops-platform-config.json, and rotate any token that may have been entered on the command line or stored by this version.
Vulnerability Patterns
- Insecure Skill Coding PracticesFinds exploitable flaws such as hardcoded secrets or command injection
- Skill Instruction HijackingAlters the agent's session goals or safety constraints when the skill loads
- Agent Memory PoisoningWrites attacker-controlled rules into memory that affect later sessions
- Remote Payload Retrieval and ExecutionFetches external code whose behavior can change after review
- Embedded Malicious CodeShips malicious scripts inside the skill and executes them locally
Findings (3)
T09 · Insecure Skill Coding Practices
Error
- Location
bin/devops-platform-enhanced.js:76- Finding
Bearer Token Can Be Sent to an Arbitrary or Cleartext API Destination
- Content
View full analysis
{ const baseUrl = config.get('baseUrl'); if (!baseUrl) { console.log(colors.red('Error: configure the API address first')); console.log(colors.yellow('Hint: run devops-platform config')); return null; } return baseUrl; }; // Common API request function const makeRequest = async (endpoint, params = {}, method = 'GET') => { const baseUrl = getBaseUrl(); const token = getToken(); if (!baseUrl || !token) { return null; } try { // Add proxy prefix const proxyPrefix = '/proxy/devopsmng'; const url = `${baseUrl}${proxyPrefix}${endpoint}`; console.log(colors.gray(`Request URL: ${url}`)); if (Object.keys(params).length > 0) { console.log(colors.gray(`Parameters: ${JSON.stringify(params)}`)); } const config = { headers: { 'authorization': `Bearer ${token}`, 'from': 'openapi', 'content-type': 'application/json' }, timeout: 15000 }; ``` The configured value is accepted without validation: ```js if (options.baseUrl) { config.set('baseUrl', options.baseUrl); console.log(colors.green('Backend address saved')); } ``` ### Technical Analysis The application accepts an arbitrary `baseUrl`, concatenates paths onto it, and attaches the bearer token to requests without first parsing or validating the destination. There is no enforcement of: - HTTPS transport. - An approved hostname or origin. - A restriction against embedded URL credentials. - A restriction against loopback, link-local, or private destinations. - Explicit confirm ...[truncated 1787 chars]- Remediation
View remediation
T09 · Insecure Skill Coding Practices
Warning
- Location
bin/devops-platform-enhanced.js:176- Finding
Token Input Is Exposed Through Command-Line Arguments and Visible Interactive Prompts
- Content
View full analysis
', 'Backend API address') .option('-t, --token ', 'User Open Token') .action(async (options) => { if (options.baseUrl) { config.set('baseUrl', options.baseUrl); console.log(colors.green('Backend address saved')); } if (options.token) { config.set('token', options.token); console.log(colors.green('Token saved')); } if (!options.baseUrl && !options.token) { const answers = await inquirer.prompt([ { type: 'input', name: 'baseUrl', message: 'Enter the backend API address:', default: config.get('baseUrl') || '' }, { type: 'input', name: 'token', message: 'Enter the user Open Token:', default: config.get('token') || '' } ]); if (answers.baseUrl) { config.set('baseUrl', answers.baseUrl); } if (answers.token) { config.set('token', answers.token); } console.log(colors.green('Configuration saved')); } }); ``` The documented usage encourages placing the token directly in the command line: ```bash devops-platform config --base-url --token ``` ### Technical Analysis Passing a token using `--token` places the secret in the process argument vector. Depending on the operating system and process isolation policy, command-line arg ...[truncated 1965 chars]- Remediation
View remediation
Vulnerability Patterns
- Data ExfiltrationExternal Transmission, Env Variable Harvesting, File System Enumeration
- Privilege EscalationExcessive Permissions, Sudo/Root Execution, Credential Access
- Supply ChainUnpinned Dependencies, External Script Fetching, Obfuscated Code
- Rogue AgentSelf-Modification, Session Persistence
- Trigger AbuseOverly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
Findings (47)
Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more
High
- Category
- Supply Chain
- Confidence
- 94% confidence
- Finding
The lockfile pins axios 1.13.6, and the supplied advisory set includes high-severity issues such as SSRF-related NO_PROXY bypass and prototype-pollution-assisted MITM/credential theft scenarios. Because this skill appears to be a DevOps/platform CLI and axios is a primary HTTP client, these flaws are more relevant than in a purely local/offline package: it may handle API tokens, internal endpoints, or proxy-controlled traffic.
- Content
Known Vulnerable Dependency: form-data==4.0.5 — 1 advisory(ies): CVE-2026-12143 (form-data: CRLF injection in form-data via unescaped multipart field names and f)
High
- Category
- Supply Chain
- Confidence
- 89% confidence
- Finding
form-data 4.0.5 is reported vulnerable to CRLF injection via unescaped multipart field names/filenames. If this skill ever builds multipart requests from user-controlled input, an attacker may be able to manipulate HTTP message structure or inject unintended parts/headers, which is especially risky for tooling that interacts with internal DevOps APIs or artifact services.
- Content
Known Vulnerable Dependency: axios==1.13.6 — 16 advisory(ies): CVE-2026-44494 (axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `co); CVE-2026-44495 (axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollut); CVE-2025-62718 (Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF) +13 more
High
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The manifest includes axios 1.13.6, which the finding states has multiple known advisories, including SSRF and man-in-the-middle/prototype-pollution-related issues. In a DevOps platform tool that likely makes authenticated API requests to internal services, vulnerable HTTP client behavior can materially increase the risk of credential theft, request hijacking, or access to internal network resources.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 90% confidence
- Finding
The example trigger phrase around this location is overly generic and maps ordinary user language directly to internal DevOps queries. Because the skill is intended for messaging platforms and natural-language interaction, such generic phrasing increases the risk of accidental activation, unauthorized information exposure in shared channels, or the agent acting on ambiguous requests without sufficient user or channel validation.
- Content
Vague Triggers
Medium
- Category
- Not specified by scanner
- Confidence
- 94% confidence
- Finding
The document presents very broad natural-language usage patterns for the agent, such as users asking generic questions in ordinary conversation, without defining explicit invocation boundaries, scope checks, or confirmation rules. In a multi-platform chat context, overly generic triggers can cause unintended skill activation, data retrieval, or disclosure in response to casual messages that merely resemble operational queries.
- Content
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
方法一：复制到Skills目录
bash # 复制skill到OpenClaw skills目录 sudo cp -r devops-platform-skill /opt/homebrew/lib/node_modules/openclaw/skills/方法二：使用clawhub发布（推荐）
Sudo/Root Execution
Medium
- Category
- Privilege Escalation
- Confidence
- 70% confidence
- Finding
Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.
- Content
方法一：复制到Skills目录
bash # 复制skill到OpenClaw skills目录 sudo cp -r devops-platform-skill /opt/homebrew/lib/node_modules/openclaw/skills/方法二：使用clawhub发布（推荐）
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The guide explicitly shows passing an API token on the command line and documents that the token is stored locally in plaintext config files. This can expose credentials through shell history, process listings, screenshots, logs, or local file compromise, making unauthorized API access more likely.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 91% confidence
- Finding
The README explicitly instructs users to configure and use an API token and also advertises detailed error/debug output, but it does not warn that tokens are sensitive secrets or that request debugging can leak credentials into terminal output, logs, screenshots, or shell history. In a DevOps platform context, exposed tokens may grant access to application, iteration, and release-management APIs, increasing the operational risk of credential disclosure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 93% confidence
- Finding
The documentation instructs users to configure an Open Token but provides no warning that the token is a sensitive credential requiring secure storage and careful handling. In a DevOps platform context, such tokens may grant access to application, iteration, and release-management data, so omission of credential-handling guidance increases the likelihood of accidental exposure.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The example command places the user token directly on the command line, which can expose it through shell history, process listings, terminal logging, or remote session recording. Because this skill interfaces with a DevOps platform API, compromise of the token could enable unauthorized access to operational and release data or actions available to that user.
- Content
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - `/application/app/{id}` - 应用详情 - `/publish/publishplan/list` - 迭代列表 - `/publish/publishplan/myplanlist` - 我的迭代 - `/publish/publishplan/applist` - 迭代应用 - `/publish/publishplan/favorite` - 收藏迭代 - `/publish/publishplan/unfavorite` - 取消收藏 - `/publish/publishplan/myfavoritelist` - 收藏列表
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - `/application/app/{id}` - 应用详情 - `/publish/publishplan/list` - 迭代列表 - `/publish/publishplan/myplanlist` - 我的迭代 - `/publish/publishplan/applist` - 迭代应用 - `/publish/publishplan/favorite` - 收藏迭代 - `/publish/publishplan/unfavorite` - 取消收藏 - `/publish/publishplan/myfavoritelist` - 收藏列表
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - `/application/app/{id}` - 应用详情 - `/publish/publishplan/list` - 迭代列表 - `/publish/publishplan/myplanlist` - 我的迭代 - `/publish/publishplan/applist` - 迭代应用 - `/publish/publishplan/favorite` - 收藏迭代 - `/publish/publishplan/unfavorite` - 取消收藏 - `/publish/publishplan/myfavoritelist` - 收藏列表
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - `/application/app/{id}` - 应用详情 - `/publish/publishplan/list` - 迭代列表 - `/publish/publishplan/myplanlist` - 我的迭代 - `/publish/publishplan/applist` - 迭代应用 - `/publish/publishplan/favorite` - 收藏迭代 - `/publish/publishplan/unfavorite` - 取消收藏 - `/publish/publishplan/myfavoritelist` - 收藏列表
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - `/application/app/{id}` - 应用详情 - `/publish/publishplan/list` - 迭代列表 - `/publish/publishplan/myplanlist` - 我的迭代 - `/publish/publishplan/applist` - 迭代应用 - `/publish/publishplan/favorite` - 收藏迭代 - `/publish/publishplan/unfavorite` - 取消收藏 - `/publish/publishplan/myfavoritelist` - 收藏列表
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
md - `/application/app/{id}` - 应用详情 - `/publish/publishplan/list` - 迭代列表 - `/publish/publishplan/myplanlist` - 我的迭代 - `/publish/publishplan/applist` - 迭代应用 - `/publish/publishplan/favorite` - 收藏迭代 - `/publish/publishplan/unfavorite` - 取消收藏 - `/publish/publishplan/myfavoritelist` - 收藏列表
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
js - `/application/app/{id}` - 应用详情 - `/publish/publishplan/list` - 迭代列表 - `/publish/publishplan/myplanlist` - 我的迭代 - `/publish/publishplan/applist` - 迭代应用 - `/publish/publishplan/favorite` - 收藏迭代 - `/publish/publishplan/unfavorite` - 取消收藏 - `/publish/publishplan/myfavoritelist` - 收藏列表
Session Persistence
Medium
- Category
- Rogue Agent
- Confidence
- 75% confidence
- Finding
Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.
- Content
js - `/application/app/{id}` - 应用详情 - `/publish/publishplan/list` - 迭代列表 - `/publish/publishplan/myplanlist` - 我的迭代 - `/publish/publishplan/applist` - 迭代应用 - `/publish/publishplan/favorite` - 收藏迭代 - `/publish/publishplan/unfavorite` - 取消收藏 - `/publish/publishplan/myfavoritelist` - 收藏列表
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 84% confidence
- Finding
This is a markdown file, so missing-warning review applies to documented behaviors affecting privacy or system integrity. The summary states that debug information shows request URLs and parameters and that configuration stores API tokens in a JSON file, but it provides no explicit user warning about protecting tokens or avoiding sensitive use in debug contexts.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 97% confidence
- Finding
The CLI stores the bearer token in a JSON file under the user's home directory without any warning, encryption, or file-permission hardening. This creates a local secret-exposure risk: other local users, malware, backups, or accidental file sharing could recover the token and use it to access the DevOps platform APIs.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 96% confidence
- Finding
The interactive prompt collects the token using a plain input field and gives no notice that the value will be stored locally afterward. This increases the chance of shoulder-surfing, terminal history/log capture, and uninformed credential persistence, making sensitive API tokens easier to expose.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 98% confidence
- Finding
The save routine writes the entire configuration object, including the API token, directly to ~/.devops-platform-config.json as formatted JSON with no encryption or permission hardening. This creates a local secret-at-rest exposure: any process or user that can read the file can steal the bearer token and impersonate the user against the DevOps platform.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI collects a bearer token from command-line options or an interactive prompt and persists it locally via the config helper, without warning the user that the credential will be stored on disk in plaintext. If the local machine is shared, compromised, backed up insecurely, or the file permissions are too broad, the token can be recovered and reused to access the backend API as the user.
- Content
Missing User Warnings
Medium
- Category
- Not specified by scanner
- Confidence
- 95% confidence
- Finding
The CLI prompts for an access token and persists it in a JSON config file under the user's home directory without any explicit warning about long-term credential storage or protections on that file. If the host is multi-user, backed up, synced, or otherwise compromised, the bearer token can be recovered and reused to access the DevOps platform API as the user.
- Content
Static analysis
Detected: suspicious.env_credential_access
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- bin/devops-platform-enhanced.js:21
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- bin/devops-platform-simple.js:18
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- bin/devops-platform-v3-complete.js:21
Environment variable access combined with network send.
Critical
- Code
- suspicious.env_credential_access
- Location
- bin/devops-platform-v3.js:21