T09 · Insecure Skill Coding Practices
Error
- Location
run_browser.js:25- Finding
Shell Command Injection Through Unsanitized URL Argument
- Content
View full analysis
{ ``` The `url` value originates directly from the command-line argument at line 14: ```js const url = process.argv[2]; ``` ### Technical Analysis The script inserts an untrusted URL directly into a command string and executes that string using `child_process.exec`. The `exec` API invokes a system shell, so shell metacharacters within the URL are interpreted by that shell. Wrapping the value in double quotes is not a sufficient defense. An attacker can include another double quote to terminate the intended argument and then append shell operators and an arbitrary command. The script currently fails during JavaScript parsing because of the invalid triple-quoted block at lines 1–10. Therefore, exploitation is blocked in the artifact exactly as reviewed. However, the command-injection flaw becomes directly reachable as soon as that syntax error is corrected without also replacing the unsafe `exec` call. ### Attack Path 1. An attacker persuades the agent or user to invoke the skill with a crafted URL. 2. The URL is read from `process.argv[2]` without validation or escaping. 3. The URL is interpolated into the shell command inside double quotes. 4. An embedded quote terminates the intended `--url` value. 5. Shell control characters introduce an additional command. 6. `exec` passes the resulting string to the system shell. 7. The injected command executes with the privileges of the OpenClaw or Node.js process. A conceptual malicious argument is: ```text "; ATTACKER_CONTROLLED_COMMAND; # ``` After interpolation, the intended `agent-browser` invocation is followed by the attacker-controlled shell command. ### Impact Assessment Successful exp ...[truncated 727 chars]- Remediation
View remediation
{ // Handle the result. } ); ``` Additionally: 1. Parse the input using `new URL(url)`. 2. Allow only required schemes, normally `https:` and, if necessary, `http:`. 3. Reject control characters, malformed URLs, and unnecessary URL schemes such as `file:`. 4. Consider restricting private, loopback, and link-local destinations if the skill should only access public websites. 5. Apply an input-length limit. 6. Add regression tests containing quotes, command substitutions, semicolons, newlines, and shell operators. 7. Run the browser process with the minimum filesystem and network privileges required. ]]>