T09 · Insecure Skill Coding Practices
Warning
- Location
index.js:128- Finding
Stored Shell Command Injection in Generated Autosave Script
- Content
View full analysis
> "$LOG_FILE" while true; do # Create today's memory file if it does not exist TODAY=$(date +%Y-%m-%d) DAILY_FILE="$MEMORY_DIR/$TODAY.md" if [ ! -f "$DAILY_FILE" ]; then echo "# $TODAY" > "$DAILY_FILE" echo "" >> "$DAILY_FILE" echo "## Automatically created memory file" >> "$DAILY_FILE" echo "Created: $(date)" >> "$DAILY_FILE" echo "" >> "$DAILY_FILE" echo "## Today's Work" >> "$DAILY_FILE" echo "[$(date)] Created daily memory file: $TODAY.md" >> "$LOG_FILE" fi # Update the memory index timestamp INDEX_FILE="$MEMORY_DIR/memory_index.json" if [ -f "$INDEX_FILE" ]; then jq '.lastUpdated = "$(date -Iseconds)"' "$INDEX_FILE" > "$INDEX_FILE.tmp" && mv "$INDEX_FILE.tmp" "$INDEX_FILE" fi # Wait until the next save sleep ${this.config.autoSaveInterval} done `; const scriptPath = path.join(this.memoryPath, 'auto_save.sh'); await fs.writeFile(scriptPath, scriptContent); await fs.chmod(scriptPath, '755'); } ``` The project documentation instructs users to execute the generated file: ```bash bash memory/auto_save.sh & ``` ### Technical Analysis The `memoryGuardian` configuration object is loaded from the workspace's `config.json` without schema ...[truncated 2247 chars]- Remediation
View remediation
86400) { throw new Error('autoSaveInterval must be an integer between 10 and 86400 seconds'); } ``` 2. Avoid generating shell source from configuration. Implement autosave scheduling directly in Node.js with `setInterval`, or execute a fixed script while passing validated data as arguments. 3. If shell generation is retained: - Use a well-reviewed shell-escaping routine for every interpolated value. - Do not place untrusted values directly in command positions. - Pass values through positional parameters or a controlled environment. - Validate `OPENCLAW_WORKSPACE` before embedding it. 4. Write the generated file with restrictive permissions, such as `0700`, unless group or global execution is explicitly required. 5. Add tests using semicolons, command substitutions, quotation marks, newlines, and other shell metacharacters to confirm that configuration values cannot alter script syntax. ]]>