T09 · Insecure Skill Coding Practices
Error
- Location
deploy.sh:14- Finding
Remote Command and SSH Option Injection Through Unsanitized Deployment Arguments
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi ``` 2. **Use Bash arrays instead of command strings** ```bash SSH=(ssh -i "$KEY" -- "$VPS") SCP=(scp -i "$KEY" --) ``` Invoke them with: ```bash "${SSH[@]}" ... "${SCP[@]}" ... ``` 3. **Quote remote arguments safely** - Serialize the path using `printf '%q'` before embedding it in a remote shell command. - Prefer invoking a fixed, audited remote deployment script with data supplied through positional parameters or standard input. Example: ```bash printf -v quoted_data '%q' "$VPS_DATA" "${SSH[@]}" "mkdir -p -- ${quoted_data}/workspace-pat/memory" ``` 4. **Reject SSH option injection** - Validate the VPS value as an expected `user@hostname` or hostname format. - Do not allow it to begin with `-`. - Keep user-controlled values in distinct array elements. - Pin expected SSH options in the script rather than accepting arbitrary options through argument fields. 5. **Replace root SSH deployment** - Create a dedicated deployment account. - Restrict its write access to the OpenClaw deployment directory. - Grant only a narrowly scoped command for restarting the intended container. - Consider SSH `authorized_keys` restrictions such as a forced command and disabled forwarding. - Do not grant unrestricted membership in the Docker group, because it is generally equivalent to root access. 6. **Add defensive SSH settings** - Use a managed `known_hosts` file and strict host-key verification. - Ensure the selected key has restrictive local permissions. - Avoid logging key material or sensitive co ...[truncated 24 chars]