T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:20- Finding
Shell Command Injection Through Unsafe Message and Recipient Interpolation
- Content
View full analysis
", "text": "", "parse_mode": "HTML" }' ``` ```bash BOT_TOKEN=$(node -e "const c=require(process.env.HOME+'/.openclaw/openclaw.json');console.log(c.channels.telegram.botToken)") for CHAT_ID in 111111111 222222222; do curl -s -X POST "https://api.telegram.org/bot${BOT_TOKEN}/sendMessage" \ -H "Content-Type: application/json" \ -d "{\"chat_id\": \"${CHAT_ID}\", \"text\": \"\", \"parse_mode\": \"HTML\"}" done ``` ### Technical Analysis The Skill instructs an agent to substitute recipient identifiers and message content directly into shell command templates. These values can originate from user requests and are not validated or encoded before being placed into shell syntax. In the first example, the JSON body is enclosed in single quotes. A message containing a single quote can terminate that quoted argument and introduce additional shell operators or commands. In the multiple-recipient example, the JSON body is enclosed in double quotes. If attacker-controlled content is inserted into the generated command, shell constructs such as `$(...)`, backticks, quotes, backslashes, and command separators can be interpreted during shell parsing rather than treated solely as Telegram message data. JSON escaping alone is insufficient because the data first passes through the shell parser. A dedicated JSON serializer must be used while keeping untrusted values out of generated shell source. ### Attack Path 1. An attacker a ...[truncated 1334 chars]- Remediation
View remediation