T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:68
- Finding
- Unsafe interpolation of user-controlled data into shell-executed SQL commands<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:68-71` and `SKILL.md:91-94` **Vulnerability Type**: Command injection and SQL injection through unsafe command construction **Risk Level**: Medium ### Complete Code Snippets `SKILL.md:68-71`: ```bash sqlite3 ~/.openclaw/family-partner/family.db \ "INSERT INTO tasks (id, title, type, assignee) \ VALUES ('t20260302150000', 'Doctor appointment', 'todo', 'Mom')" ``` `SKILL.md:91-94`: ```bash sqlite3 ~/.openclaw/family-partner/family.db \ "INSERT INTO memories (id, member_name, type, content) \ VALUES ('m20260302150000', 'Ethan', 'allergy', 'Allergic to peanuts')" ``` ### Technical Analysis The Skill directs the agent to process arbitrary natural-language values—such as task titles, family-member names, locations, preferences, and medical notes—and insert them into SQL statements executed through a shell. However, it provides no parameter-binding mechanism, escaping rules, input validation, or instruction to avoid shell interpretation. The SQL statement is supplied as a double-quoted shell argument. If an implementation directly substitutes user-controlled text into this template, two parsing boundaries become security-sensitive: 1. **Shell parsing:** Command substitutions such as `$(...)` or backticks inside a double-quoted shell argument may be evaluated by the shell before `sqlite3` starts. 2. **SQL parsing:** Quotes and SQL metacharacters in user-controlled values may terminate the intended string literal and alter the statement. The examples contain fixed benign values, but they are presented as operative patterns for handling user requests. Reusing these patterns with untrusted values creates a credible injection risk. ### Attack Path 1. An attacker submits a task, memory, event, location, participant, or other field containing shell substitution syntax or SQL metacharacters. 2. The AI agent places that value into one of the documented `sqlite3` command templates. 3. The gene ...[truncated 1364 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace shell-built SQL statements with a local helper implemented using a SQLite library that supports parameterized queries. 2. Bind every user-derived value as a parameter; never concatenate task titles, names, locations, medical notes, or other natural-language input into SQL text. 3. Invoke the helper directly through an argument-array API rather than through `sh -c`, `bash -c`, or another shell interpreter. 4. Define strict validation for structured fields: - Parse dates and timestamps against explicit formats. - Require numeric ranges for durations, years, goals, and progress. - Restrict status, type, and category fields to documented enumerations. - Enforce reasonable length limits on free-text fields. 5. Treat escaping as a fallback rather than a substitute for parameter binding. If the SQLite CLI must be retained, transfer values through a mechanism that avoids both shell and SQL interpolation. 6. Add tests covering apostrophes, quotation marks, semicolons, dollar signs, command-substitution syntax, backticks, newlines, and Unicode input. 7. Update `SKILL.md` to explicitly prohibit direct interpolation of user-controlled content into shell commands. 8. Run OpenClaw under a dedicated, non-privileged account with access limited to `~/.openclaw/family-partner/` to reduce the impact of any command injection. ]]>