T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/configure.mjs:58- Finding
API Key Exposure Through Command-Line Arguments and Shell History
- Content
View full analysis
= 0 ? args[switchIdx + 1] : null const keyArg = args.find(a => a.startsWith('fsk-')) ``` It is transmitted as an authorization credential: ```javascript resp = await fetch(url, { headers: { Authorization: `Bearer ${apiKey}` }, signal: ctrl.signal, }) ``` The documented invocation places the credential directly on the command line: ```bash node scripts/configure.mjs fsk-your-key ``` ### Technical Analysis The program accepts the API key exclusively through `process.argv`. Command-line arguments are not an appropriate secret-input channel because they can be exposed through: - Shell history files. - Process-listing and monitoring utilities. - Process accounting and endpoint telemetry. - Terminal session recording. - Diagnostic reports that capture command lines. - Wrapper scripts or automation logs. The `--env` option only changes how the key is written into `openclaw.json`; it does not protect initial key entry. Even in that mode, the documented command still passes the secret through `argv`. The user guide also recommends displaying the environment variable with `echo`, which can expose the complete key in terminal scrollback, support recordings, or CI logs. ### Attack Path 1. A vi ...[truncated 1098 chars]- Remediation
View remediation