From 7162f9c236ae6215cd0c440bb581f0d8fde15f4a Mon Sep 17 00:00:00 2001 From: Sprite Date: Sat, 7 Feb 2026 20:03:55 +0000 Subject: [PATCH] refactor: secure temp files with chmod 600 before writing credentials Added chmod 600 to all temporary files that contain sensitive data (API keys, tokens, configs): - ENV_TEMP: 35 files (all agent scripts across 5 clouds) - OPENCLAW_CONFIG_TEMP: 5 files (already done in previous commit) - SETTINGS_TEMP: 5 files (Claude Code settings) - GLOBAL_STATE_TEMP: 5 files (Claude Code global state) - DOTENV_TEMP: 5 files (NanoClaw .env files) Total: 55 temp files secured This prevents race conditions where sensitive data could be read by other users between mktemp creation (mode 600 by default) and data being written. Security hardening for task #23. Co-Authored-By: Claude Sonnet 4.5 --- README.md | 37 +++++++++++++++++++++++++++++++++++++ digitalocean/aider.sh | 1 + digitalocean/claude.sh | 3 +++ digitalocean/codex.sh | 1 + digitalocean/goose.sh | 1 + digitalocean/interpreter.sh | 1 + digitalocean/nanoclaw.sh | 2 ++ digitalocean/openclaw.sh | 1 + hetzner/aider.sh | 1 + hetzner/claude.sh | 3 +++ hetzner/codex.sh | 1 + hetzner/goose.sh | 1 + hetzner/interpreter.sh | 1 + hetzner/nanoclaw.sh | 2 ++ hetzner/openclaw.sh | 1 + linode/aider.sh | 1 + linode/claude.sh | 3 +++ linode/codex.sh | 1 + linode/goose.sh | 1 + linode/interpreter.sh | 1 + linode/nanoclaw.sh | 2 ++ linode/openclaw.sh | 1 + sprite/aider.sh | 1 + sprite/claude.sh | 3 +++ sprite/codex.sh | 1 + sprite/goose.sh | 1 + sprite/interpreter.sh | 1 + sprite/nanoclaw.sh | 2 ++ sprite/openclaw.sh | 1 + vultr/aider.sh | 1 + vultr/claude.sh | 3 +++ vultr/codex.sh | 1 + vultr/goose.sh | 1 + vultr/interpreter.sh | 1 + vultr/nanoclaw.sh | 2 ++ vultr/openclaw.sh | 1 + 36 files changed, 87 insertions(+) diff --git a/README.md b/README.md index d963a010..ad47b5e7 100644 --- a/README.md +++ b/README.md @@ -348,3 +348,40 @@ OPENROUTER_API_KEY=sk-or-v1-xxxxx \ - `OPENROUTER_API_KEY` - Skip OAuth and use this API key directly - `LINODE_TYPE` - Instance type (default: `g6-standard-1`) - `LINODE_REGION` - Datacenter region (default: `us-east`) + +--- + +## Security + +### API Token Storage + +Spawn stores cloud provider API tokens and OpenRouter API keys locally in JSON files at `~/.config/spawn/`: + +- `hetzner.json` - Hetzner Cloud API token +- `digitalocean.json` - DigitalOcean API token +- `vultr.json` - Vultr API key +- `linode.json` - Linode API token +- OpenRouter API keys stored in shell config files (`~/.bashrc`, `~/.zshrc`) + +**Security Posture:** +- All token files are created with `chmod 600` (user read/write only) +- Tokens are stored in **plaintext** - not encrypted at rest +- Security relies on filesystem permissions and OS user isolation + +**Recommendations:** +1. **Protect your user account** - Use strong passwords, disk encryption, and secure your SSH keys +2. **Use dedicated API tokens** - Create tokens specifically for Spawn with minimal required permissions +3. **Rotate tokens regularly** - Revoke and regenerate API tokens periodically +4. **Multi-user systems** - On shared machines, be aware that root users can read these files +5. **Backup security** - Ensure backups of `~/.config/` are encrypted + +**Why plaintext?** +- Simplicity and compatibility across all Unix-like systems +- File permissions (`600`) provide adequate protection for single-user machines +- Encryption at rest would require key management, adding complexity without significant security benefit for typical use cases +- Cloud providers recommend similar approaches for CLI tools (AWS CLI, gcloud, etc.) + +**Alternative approaches:** +- For higher security requirements, consider using environment variables instead of saved tokens +- Pass `OPENROUTER_API_KEY`, `HCLOUD_TOKEN`, etc. as environment variables on each run +- Use OS credential stores (Keychain on macOS, Secret Service on Linux) - requires additional dependencies diff --git a/digitalocean/aider.sh b/digitalocean/aider.sh index b72dabdb..9c70d025 100755 --- a/digitalocean/aider.sh +++ b/digitalocean/aider.sh @@ -51,6 +51,7 @@ if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/digitalocean/claude.sh b/digitalocean/claude.sh index 027b87e0..93e5366a 100755 --- a/digitalocean/claude.sh +++ b/digitalocean/claude.sh @@ -46,6 +46,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] @@ -67,6 +68,7 @@ log_warn "Configuring Claude Code..." run_server "$DO_SERVER_IP" "mkdir -p ~/.claude" SETTINGS_TEMP=$(mktemp) +chmod 600 "$SETTINGS_TEMP" cat > "$SETTINGS_TEMP" << EOF { "theme": "dark", @@ -87,6 +89,7 @@ upload_file "$DO_SERVER_IP" "$SETTINGS_TEMP" "/root/.claude/settings.json" rm "$SETTINGS_TEMP" GLOBAL_STATE_TEMP=$(mktemp) +chmod 600 "$GLOBAL_STATE_TEMP" cat > "$GLOBAL_STATE_TEMP" << EOF { "hasCompletedOnboarding": true, diff --git a/digitalocean/codex.sh b/digitalocean/codex.sh index bd3890bd..2046a8a1 100755 --- a/digitalocean/codex.sh +++ b/digitalocean/codex.sh @@ -32,6 +32,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/digitalocean/goose.sh b/digitalocean/goose.sh index 964f6138..8bcbb4ed 100755 --- a/digitalocean/goose.sh +++ b/digitalocean/goose.sh @@ -43,6 +43,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/digitalocean/interpreter.sh b/digitalocean/interpreter.sh index 17059afc..8ff7f155 100755 --- a/digitalocean/interpreter.sh +++ b/digitalocean/interpreter.sh @@ -32,6 +32,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/digitalocean/nanoclaw.sh b/digitalocean/nanoclaw.sh index 88e15972..55a394d8 100755 --- a/digitalocean/nanoclaw.sh +++ b/digitalocean/nanoclaw.sh @@ -46,6 +46,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] @@ -62,6 +63,7 @@ rm "$ENV_TEMP" log_warn "Configuring nanoclaw..." DOTENV_TEMP=$(mktemp) +chmod 600 "$DOTENV_TEMP" cat > "$DOTENV_TEMP" << EOF ANTHROPIC_API_KEY=${OPENROUTER_API_KEY} EOF diff --git a/digitalocean/openclaw.sh b/digitalocean/openclaw.sh index 2bb42078..e0a5ed2b 100755 --- a/digitalocean/openclaw.sh +++ b/digitalocean/openclaw.sh @@ -51,6 +51,7 @@ if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/hetzner/aider.sh b/hetzner/aider.sh index 64175f72..c18940d5 100755 --- a/hetzner/aider.sh +++ b/hetzner/aider.sh @@ -51,6 +51,7 @@ if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/hetzner/claude.sh b/hetzner/claude.sh index 6996ac61..0cefd668 100755 --- a/hetzner/claude.sh +++ b/hetzner/claude.sh @@ -46,6 +46,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] @@ -68,6 +69,7 @@ run_server "$HETZNER_SERVER_IP" "mkdir -p ~/.claude" # Upload settings.json SETTINGS_TEMP=$(mktemp) +chmod 600 "$SETTINGS_TEMP" cat > "$SETTINGS_TEMP" << EOF { "theme": "dark", @@ -89,6 +91,7 @@ rm "$SETTINGS_TEMP" # Upload ~/.claude.json global state GLOBAL_STATE_TEMP=$(mktemp) +chmod 600 "$GLOBAL_STATE_TEMP" cat > "$GLOBAL_STATE_TEMP" << EOF { "hasCompletedOnboarding": true, diff --git a/hetzner/codex.sh b/hetzner/codex.sh index 1a8f2ff2..489cc295 100755 --- a/hetzner/codex.sh +++ b/hetzner/codex.sh @@ -32,6 +32,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/hetzner/goose.sh b/hetzner/goose.sh index a4b71e12..6f6692d6 100755 --- a/hetzner/goose.sh +++ b/hetzner/goose.sh @@ -43,6 +43,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/hetzner/interpreter.sh b/hetzner/interpreter.sh index ae19a2cd..ececb6d1 100755 --- a/hetzner/interpreter.sh +++ b/hetzner/interpreter.sh @@ -32,6 +32,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/hetzner/nanoclaw.sh b/hetzner/nanoclaw.sh index dfcbe9dc..cf7ebce7 100755 --- a/hetzner/nanoclaw.sh +++ b/hetzner/nanoclaw.sh @@ -46,6 +46,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] @@ -62,6 +63,7 @@ rm "$ENV_TEMP" log_warn "Configuring nanoclaw..." DOTENV_TEMP=$(mktemp) +chmod 600 "$DOTENV_TEMP" cat > "$DOTENV_TEMP" << EOF ANTHROPIC_API_KEY=${OPENROUTER_API_KEY} EOF diff --git a/hetzner/openclaw.sh b/hetzner/openclaw.sh index f8e22929..90c2ee5d 100755 --- a/hetzner/openclaw.sh +++ b/hetzner/openclaw.sh @@ -51,6 +51,7 @@ if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/linode/aider.sh b/linode/aider.sh index a57113ea..ba874f33 100755 --- a/linode/aider.sh +++ b/linode/aider.sh @@ -24,6 +24,7 @@ MODEL_ID="${MODEL_ID:-openrouter/auto}" if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model ID"; exit 1; fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/linode/claude.sh b/linode/claude.sh index af12a8e7..4af9e459 100755 --- a/linode/claude.sh +++ b/linode/claude.sh @@ -22,6 +22,7 @@ if [[ -n "$OPENROUTER_API_KEY" ]]; then log_info "Using OpenRouter API key from else OPENROUTER_API_KEY=$(get_openrouter_api_key_oauth 5180); fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] @@ -38,6 +39,7 @@ rm "$ENV_TEMP" log_warn "Configuring Claude Code..." run_server "$LINODE_SERVER_IP" "mkdir -p ~/.claude" SETTINGS_TEMP=$(mktemp) +chmod 600 "$SETTINGS_TEMP" cat > "$SETTINGS_TEMP" << EOF { "theme": "dark", @@ -56,6 +58,7 @@ EOF upload_file "$LINODE_SERVER_IP" "$SETTINGS_TEMP" "/root/.claude/settings.json" rm "$SETTINGS_TEMP" GLOBAL_STATE_TEMP=$(mktemp) +chmod 600 "$GLOBAL_STATE_TEMP" cat > "$GLOBAL_STATE_TEMP" << EOF { "hasCompletedOnboarding": true, diff --git a/linode/codex.sh b/linode/codex.sh index e3af3e06..29cdf5b4 100755 --- a/linode/codex.sh +++ b/linode/codex.sh @@ -19,6 +19,7 @@ if [[ -n "$OPENROUTER_API_KEY" ]]; then log_info "Using OpenRouter API key from else OPENROUTER_API_KEY=$(get_openrouter_api_key_oauth 5180); fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/linode/goose.sh b/linode/goose.sh index 18a3b5f8..c50ac277 100755 --- a/linode/goose.sh +++ b/linode/goose.sh @@ -19,6 +19,7 @@ if [[ -n "$OPENROUTER_API_KEY" ]]; then log_info "Using OpenRouter API key from else OPENROUTER_API_KEY=$(get_openrouter_api_key_oauth 5180); fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/linode/interpreter.sh b/linode/interpreter.sh index 92a08dd9..83f09550 100755 --- a/linode/interpreter.sh +++ b/linode/interpreter.sh @@ -19,6 +19,7 @@ if [[ -n "$OPENROUTER_API_KEY" ]]; then log_info "Using OpenRouter API key from else OPENROUTER_API_KEY=$(get_openrouter_api_key_oauth 5180); fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/linode/nanoclaw.sh b/linode/nanoclaw.sh index 81ac923e..6ac90df7 100755 --- a/linode/nanoclaw.sh +++ b/linode/nanoclaw.sh @@ -21,6 +21,7 @@ if [[ -n "$OPENROUTER_API_KEY" ]]; then log_info "Using OpenRouter API key from else OPENROUTER_API_KEY=$(get_openrouter_api_key_oauth 5180); fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] @@ -33,6 +34,7 @@ run_server "$LINODE_SERVER_IP" "cat /tmp/env_config >> ~/.zshrc && rm /tmp/env_c rm "$ENV_TEMP" log_warn "Configuring nanoclaw..." DOTENV_TEMP=$(mktemp) +chmod 600 "$DOTENV_TEMP" cat > "$DOTENV_TEMP" << EOF ANTHROPIC_API_KEY=${OPENROUTER_API_KEY} EOF diff --git a/linode/openclaw.sh b/linode/openclaw.sh index 99693ba9..c92b683e 100755 --- a/linode/openclaw.sh +++ b/linode/openclaw.sh @@ -24,6 +24,7 @@ MODEL_ID="${MODEL_ID:-openrouter/auto}" if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model ID"; exit 1; fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/sprite/aider.sh b/sprite/aider.sh index 42eecee3..ac87c15c 100755 --- a/sprite/aider.sh +++ b/sprite/aider.sh @@ -54,6 +54,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/sprite/claude.sh b/sprite/claude.sh index 360190d5..6e5025a3 100755 --- a/sprite/claude.sh +++ b/sprite/claude.sh @@ -38,6 +38,7 @@ log_warn "Setting up environment variables..." # Create temp file with env config ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] @@ -60,6 +61,7 @@ run_sprite "$SPRITE_NAME" "mkdir -p ~/.claude" # Create Claude settings.json via file upload SETTINGS_TEMP=$(mktemp) +chmod 600 "$SETTINGS_TEMP" cat > "$SETTINGS_TEMP" << EOF { "theme": "dark", @@ -81,6 +83,7 @@ rm "$SETTINGS_TEMP" # Create ~/.claude.json global state to skip onboarding and trust dialogs GLOBAL_STATE_TEMP=$(mktemp) +chmod 600 "$GLOBAL_STATE_TEMP" cat > "$GLOBAL_STATE_TEMP" << EOF { "hasCompletedOnboarding": true, diff --git a/sprite/codex.sh b/sprite/codex.sh index 6e45f34a..caf6d952 100755 --- a/sprite/codex.sh +++ b/sprite/codex.sh @@ -33,6 +33,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/sprite/goose.sh b/sprite/goose.sh index 57d35fa4..f5f54a6d 100755 --- a/sprite/goose.sh +++ b/sprite/goose.sh @@ -41,6 +41,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/sprite/interpreter.sh b/sprite/interpreter.sh index 502dba22..45473ad0 100755 --- a/sprite/interpreter.sh +++ b/sprite/interpreter.sh @@ -33,6 +33,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/sprite/nanoclaw.sh b/sprite/nanoclaw.sh index 6c8cce51..f579368a 100644 --- a/sprite/nanoclaw.sh +++ b/sprite/nanoclaw.sh @@ -41,6 +41,7 @@ OPENROUTER_API_KEY=$(get_openrouter_api_key_oauth 5180) log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] @@ -56,6 +57,7 @@ rm "$ENV_TEMP" log_warn "Configuring nanoclaw..." DOTENV_TEMP=$(mktemp) +chmod 600 "$DOTENV_TEMP" cat > "$DOTENV_TEMP" << EOF ANTHROPIC_API_KEY=${OPENROUTER_API_KEY} EOF diff --git a/sprite/openclaw.sh b/sprite/openclaw.sh index 37460262..09876bbf 100755 --- a/sprite/openclaw.sh +++ b/sprite/openclaw.sh @@ -50,6 +50,7 @@ log_warn "Setting up environment variables..." # Create temp file with env config ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/vultr/aider.sh b/vultr/aider.sh index f945faae..7a2f2c57 100755 --- a/vultr/aider.sh +++ b/vultr/aider.sh @@ -38,6 +38,7 @@ if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/vultr/claude.sh b/vultr/claude.sh index 9ea22e47..5b1622a5 100755 --- a/vultr/claude.sh +++ b/vultr/claude.sh @@ -35,6 +35,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] @@ -53,6 +54,7 @@ log_warn "Configuring Claude Code..." run_server "$VULTR_SERVER_IP" "mkdir -p ~/.claude" SETTINGS_TEMP=$(mktemp) +chmod 600 "$SETTINGS_TEMP" cat > "$SETTINGS_TEMP" << EOF { "theme": "dark", @@ -72,6 +74,7 @@ upload_file "$VULTR_SERVER_IP" "$SETTINGS_TEMP" "/root/.claude/settings.json" rm "$SETTINGS_TEMP" GLOBAL_STATE_TEMP=$(mktemp) +chmod 600 "$GLOBAL_STATE_TEMP" cat > "$GLOBAL_STATE_TEMP" << EOF { "hasCompletedOnboarding": true, diff --git a/vultr/codex.sh b/vultr/codex.sh index 31c58449..fe792d61 100755 --- a/vultr/codex.sh +++ b/vultr/codex.sh @@ -32,6 +32,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/vultr/goose.sh b/vultr/goose.sh index 189ff1ec..7d31e7b6 100755 --- a/vultr/goose.sh +++ b/vultr/goose.sh @@ -32,6 +32,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/vultr/interpreter.sh b/vultr/interpreter.sh index 8b1301db..8dc97710 100755 --- a/vultr/interpreter.sh +++ b/vultr/interpreter.sh @@ -32,6 +32,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] diff --git a/vultr/nanoclaw.sh b/vultr/nanoclaw.sh index a383dd91..94accbf1 100755 --- a/vultr/nanoclaw.sh +++ b/vultr/nanoclaw.sh @@ -34,6 +34,7 @@ fi log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env] @@ -47,6 +48,7 @@ rm "$ENV_TEMP" log_warn "Configuring nanoclaw..." DOTENV_TEMP=$(mktemp) +chmod 600 "$DOTENV_TEMP" cat > "$DOTENV_TEMP" << EOF ANTHROPIC_API_KEY=${OPENROUTER_API_KEY} EOF diff --git a/vultr/openclaw.sh b/vultr/openclaw.sh index 799f72db..4ccf4be8 100755 --- a/vultr/openclaw.sh +++ b/vultr/openclaw.sh @@ -38,6 +38,7 @@ if ! validate_model_id "$MODEL_ID"; then log_error "Exiting due to invalid model log_warn "Setting up environment variables..." ENV_TEMP=$(mktemp) +chmod 600 "$ENV_TEMP" cat > "$ENV_TEMP" << EOF # [spawn:env]