T09 · Insecure Skill Coding Practices
Error
- Location
scripts/deploy.js:147- Finding
Arbitrary JavaScript Execution Through Unsafe Generated Source Code
- Content
View full analysis
r.id); const selectedRoles = ROLES.filter(r => roleIds.includes(r.id)); const names = {}; for (const r of selectedRoles) names[r.id] = (json.roleNames && json.roleNames[r.id]) || r.dname; return { teamName: json.teamName || 'Alpha Team', workDir: json.workspaceDir || path.join(home, '.openclaw', 'workspace-team'), tz: json.timezone || 'Asia/Shanghai', mh: json.morningHour || 8, eh: json.eveningHour || 18, tm: json.thinkingModel || suggestModel('think', detectModels()) || 'zai/glm-5', em: json.executionModel || suggestModel('exec', detectModels()) || 'zai/glm-4.7', ceoTitle: json.ceoTitle || 'Boss', selectedRoles, names, }; } ``` These values are then inserted directly into executable JavaScript: ```javascript const wsPath = cfg.workDir.replace(/\\/g, '/').replace(home.replace(/\\/g, '/'), '~'); const agentList = prefixedRoles.map(r => ` { id: "${r.pid}", name: "${cfg.names[r.id]}", workspace: "${wsPath}", model: { primary: "${r.think ? cfg.tm : cfg.em}" }, identity: { name: "${cfg.names[r.id]}" } }`).join(',\n'); const allIds = ['main', ...prefixedRoles.map(r => `"${r.pid}"`)].join(', '); w(path.join(cfg.workDir, 'apply-config.js'), `#!/usr/bin/env node\nconst fs = require('fs');\nconst path = require('path');\nconst cfgPath = path.join(process.env.HOME || process.env.USERPROFILE, '.openclaw', 'openclaw.json');\nlet config = JSON.parse(fs.readFileSync(cfgPath, 'utf8'));\nif (!config.agents) config.agents = {};\nif (!Array ...[truncated 2933 chars]- Remediation
View remediation