T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:306
- Finding
- Unscoped force termination of the process owning a selected port<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:306-311` **Vulnerability Type**: Unvalidated destructive process management **Risk Level**: Medium ### Vulnerable Code ```powershell # 2. 清理端口 Write-Host "📋 清理端口 $Port..." -ForegroundColor Yellow $connection = Get-NetTCPConnection -LocalPort $Port -ErrorAction SilentlyContinue if ($connection) { Stop-Process -Id $connection.OwningProcess -Force Start-Sleep -Seconds 2 } ``` ### Technical Analysis The gateway repair procedure obtains the process associated with the caller-selected local port and forcibly terminates it. It does not verify that the owning process is an OpenClaw Gateway, validate its executable path or command line, or request confirmation before termination. The script accepts the target through the unrestricted integer parameter `$Port`. Consequently, invoking the repair procedure with a port used by an unrelated application causes that application's process to be terminated. Multiple matching connections may also result in more than one process identifier being passed to `Stop-Process`. This is an unsafe destructive operation rather than evidence of intentional malicious behavior. ### Attack Path 1. Identify a local port used by an unrelated, security-sensitive, or availability-sensitive process. 2. Invoke the documented gateway repair script with that port through its `-Port` parameter. 3. `Get-NetTCPConnection` returns the owning process identifier. 4. The script passes that identifier directly to `Stop-Process -Force`. 5. The unrelated process is terminated without identity validation or user confirmation. ### Impact Assessment An attacker or mistaken operator who can invoke the repair procedure can terminate processes under the privileges of the script. If the script runs with elevated privileges, the scope includes processes that the same elevated account is permitted to stop. Potential consequences include denial of service, interrupted transactions, loss of ...[truncated 151 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Restrict the accepted port to the configured OpenClaw Gateway port or an explicitly approved range. 2. Resolve every owning PID and verify its executable path, process name, and command line before termination. 3. Require the process command line to identify an OpenClaw Gateway instance. 4. Display the process identity and obtain explicit confirmation before stopping it. 5. Attempt graceful Gateway shutdown before using `Stop-Process`. 6. Use `-Force` only as a final fallback after a bounded graceful-shutdown timeout. 7. Handle multiple connections individually and reject ambiguous process ownership. 8. Record the PID and validation evidence in an audit log. ]]>