T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:589
- Finding
- Shell Command Injection Through Unsafely Interpolated Session Report Content## Vulnerability Details **File Location**: `SKILL.md`, lines 589–593 **Vulnerability Type**: Shell command injection caused by unsafe interpolation of user-controlled content **Risk Level**: High ### Vulnerable Code ```bash **Automation command:** ```bash # Save session record to desktop openclaw file write --path ~/Desktop/ERP练习记录_$(date +%Y-%m-%d).md --content "[GENERATED_REPORT]" ``` ``` The nested Markdown fences above reflect the complete relevant segment as written in the skill document. The vulnerable command is: ```bash openclaw file write --path ~/Desktop/ERP练习记录_$(date +%Y-%m-%d).md --content "[GENERATED_REPORT]" ``` ### Technical Analysis The skill directs the agent to generate a report containing user-influenced values, including exposure descriptions, feared outcomes, observations, ritual notes, and retrieval cues. It then places the entire generated report into a double-quoted shell argument represented by `[GENERATED_REPORT]`. If the agent performs textual substitution and executes the resulting command through a shell, report content containing a double quote can terminate the intended argument. Shell metacharacters, command substitutions such as `$()`, or backticks may then be interpreted by the shell rather than passed literally to `openclaw file write`. Double quotes do not suppress command substitution in common shells. Consequently, merely replacing the placeholder while preserving the surrounding quotes is not a safe encoding strategy. This issue depends on the documented template being materialized into a shell command, but that is the explicit automation behavior prescribed by the skill. ### Attack Path 1. A user supplies a session value that will appear in the generated report, such as an exposure description, feared outcome, observation, or retrieval cue. 2. The supplied value contains shell syntax designed to terminate or alter the `--content` argument, or contains command substitu ...[truncated 1388 chars]
- Remediation
- ## Remediation Suggestions 1. **Do not place generated report content directly into a shell command.** Use an OpenClaw file-writing tool or structured API that accepts the destination path and content as separate, non-shell parameters. 2. **Avoid shell evaluation entirely.** Generate the destination filename in application logic and invoke the file API directly rather than using `$(date ...)` and textual command construction. 3. **Use a standard-input interface if a command-line operation is unavoidable.** Pass report data through standard input to a program that does not reevaluate the content as shell syntax. Keep the shell command itself static. 4. **Do not rely on manual escaping.** Report content may contain quotes, dollar signs, backticks, newlines, Unicode characters, and other shell-sensitive data. Ad hoc replacement is error-prone. 5. **Use an argument-array execution API.** If OpenClaw must be invoked as a subprocess, provide each argument separately without `shell=true`, `sh -c`, or equivalent shell parsing. 6. **Constrain file destinations.** Resolve the output path to a dedicated ERP records directory, reject path traversal, and create files with restrictive permissions because the reports contain sensitive health information. 7. **Add adversarial tests.** Verify that report fields containing double quotes, single quotes, `$()`, backticks, semicolons, pipes, redirection operators, command-line options, and multiline text are written literally and never executed.