Tainted flow: 'LOG_FILE' from os.environ.get (line 40, credential/environment) → open (file write)
Medium
- Category
- Data Flow
- Content
def log_event(event: dict): event["ts"] = datetime.now().isoformat() with open(LOG_FILE, "a", encoding="utf-8") as f: f.write(json.dumps(event, ensure_ascii=False) + "\n") # ========================================- Confidence
- 84% confidence
- Finding
- The log file path is derived from OPENCLAW_WORKSPACE and then used for appending without validating or constraining the resolved location. If an attacker can influence that environment variable, they can redirect writes to unintended files or locations, causing unauthorized file creation/modification or data leakage via logs. In this skill context the writes are limited to JSONL logging, so this is not arbitrary code execution, but it is a real filesystem integrity issue.