openclaw - 💡(How to fix) Fix Plaintext --password flag exposes credentials in process listing and shell history [1 comments, 2 participants]

Severity: medium / Confidence: high / Category: security Triage: confirmed-bug Detected against: openclaw v2026.5.18 (latest stable at time of scan, 2026-05-18) Tooling: clawpatch 0.3.0 + acpx/claude-sonnet-4-5 via Brad Mills protocol

Evidence

• apps/macos/Sources/OpenClawMacCLI/EntryPoint.swift:38-41 (printUsage)

openclaw-mac connect [--url <ws://host:port>] [--token <token>] [--password <password>]

• apps/macos/Sources/OpenClawMacCLI/EntryPoint.swift:43-46 (printUsage)

openclaw-mac configure-remote --ssh-target <user@host[:port]> [--local-port <port>]
                          [--remote-port <port>] [--token <token>] [--password <password>]

Reasoning

Both connect and configure-remote accept a --password flag as a positional CLI argument. On macOS and Linux, ps aux output and shell history (bash_history, zsh_history) record all arguments verbatim, meaning any gateway password passed this way is readable by other processes on the same user session and persisted in history files. For a tool that manages gateway authentication, this is a meaningful credential-exposure risk, especially in shared or CI environments where shell history may be logged.

Reproduction

Run openclaw-mac connect --password mysecret then execute ps aux | grep openclaw-mac in a concurrent shell before the process exits — the password appears in the process list.

Recommendation

Add a --password-stdin flag that reads the credential from stdin (consistent with Docker/SSH patterns). Alternatively, support an environment variable (e.g. OPENCLAW_MAC_PASSWORD) as a safe alternative. Retain the --password flag for backwards compatibility but note in the help text that it exposes the value in process listings. For tokens specifically (which are also passed as --token), consider the same treatment.

Why existing tests miss this

The provided tests focus on AppState, AgentWorkspace, AgentEventStore, AnyCodable, and AudioInputDeviceObserver — none of which exercise the CLI argument parsing or flag handling in the entrypoint. There is no test for the connect or configure-remote command dispatch paths.

Suggested regression test

Add an integration test that invokes OpenClawMacCLI with --password-stdin, writes a credential to its stdin pipe, and verifies the process does not receive the password as a CLI argument visible through process inspection.

Minimum fix scope

Add --password-stdin support in the connect and configure-remote handlers and document it in printUsage. No change needed to the entrypoint dispatch itself.

Standardized clawpatch finding. Persistent in v2026.5.18 (not resolved by upgrading from v2026.5.12). Finding ID: fnd_sig-feat-cli-command-035db88068-_b2a8287463.