T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:432- Finding
PowerShell Command Injection Through User-Controlled Agent and Skill Names
- Content
View full analysis
&1 ``` ```powershell $skillInstallCmd = "clawhub install $Skill --workdir `"$env:USERPROFILE\.openclaw\workspace-$Name`"" Invoke-Expression $skillInstallCmd 2>&1 | Out-Null ``` ### Technical Analysis The PowerShell implementation incorporates the user-controlled `$Name` and `$Skill` parameters into command strings and executes those strings through `Invoke-Expression`. This cmdlet treats the resulting string as PowerShell source code rather than as a command with isolated arguments. Although the documentation states that agent names may contain only letters, digits, and hyphens, the script does not implement that validation. The optional Skill name is likewise not validated. An attacker can therefore include PowerShell metacharacters, expression syntax, separators, or quoting characters in either parameter and alter the command parsed by `Invoke-Expression`. Quoting only the workspace path does not prevent exploitation because `$Name` is also interpolated into an unquoted command argument, and `$Skill` is directly inserted into the Skill installation command. ### Attack Path 1. An attacker supplies a crafted agent name or Skill name containing PowerShell syntax. 2. The value is accepted because the script performs no allowlist validation. 3. The value is interpolated into `$agentCmd` or `$skillInstallCmd`. 4. `Invoke-Expression` parses the complete attacker-influenced string as PowerShell code. 5. The injected command executes with the privileges of the user running the generated factory script. ### Impact Assessment Successful exploitation provides arbitrary local command execution under the account running t ...[truncated 590 chars]- Remediation
View remediation