T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:44- Finding
Shell Command Injection Through Unvalidated Deployment Parameters
- Content
View full analysis
\ --workspace /root/.openclaw/workspace- \ --model \ --non-interactive ``` ```bash openclaw channels add \ --channel feishu \ --account \ --name "<显示名称>" openclaw config set "channels.feishu.accounts..appId" "" openclaw config set "channels.feishu.accounts..appSecret" "" ``` ```bash openclaw agents bind \ --agent \ --bind "feishu:" ``` ### Technical Analysis The skill instructs the agent to extract the Agent ID, model identifier, display name, Feishu application ID, and Feishu application secret from user-controlled input and interpolate them directly into shell commands. The document does not require strict input validation, allowlisting, or shell-safe argument construction. Placing a value inside double quotes does not make arbitrary shell input safe. Shell constructs such as command substitutions remain active inside double quotes, while embedded quotation marks and shell metacharacters can terminate an argument and introduce additional commands. The Agent ID is also inserted into configuration keys, workspace paths, account identifiers, and route bindings. A malicious value may therefore affect both shell parsing and the structure of the OpenClaw configuration. ### Attack Path 1. An attacker submits a Bot deployment request containing shell syntax in a supported field, such as the display name, model, Agent ID, `appId`, or `appSecret`. 2. For example, an attacker supplies an `appSecret` containing a command substitution such as `$(malicious-command)`. 3. The agent substitutes that value into the documented command: ```bash openclaw config set "channels.feishu.accounts.agent.appSecret" "$(malicious-command ...[truncated 1347 chars]- Remediation
View remediation