OpenClaw skills.status could leak secrets to operator.read clients
Summary
OpenClaw skills.status could leak secrets to operator.read clients
Original description
The description as published by the source.
OpenClaw is a personal AI assistant. Prior to version 2026.2.14, skills.status could disclose secrets to operator.read clients by returning raw resolved config values in configChecks for skill requires.config paths. Version 2026.2.14 stops including raw resolved config values in requirement checks (return only { path, satisfied }) and narrows the Discord skill requirement to the token key. In addition to upgrading, users should rotate any Discord tokens that may have been exposed to read-scoped clients.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- web github.com