T09 · Insecure Skill Coding Practices
Error
- Location
index.js:86- Finding
Remotely Triggerable Operating System Command Injection
- Content
View full analysis
100) { processedMessages.clear(); } console.log(`[telegram-qq-bridge] Forwarding to QQ: ${cleanText.substring(0, 100)}`); // Invoke openclaw message send const cmd = `openclaw message send --channel qqbot --account ${CONFIG.qqAccount} --target "${CONFIG.qqTarget}" --message "[Telegram] ${cleanText}"`; try { const result = require('child_process').execSync(cmd, { encoding: 'utf-8', timeout: 30000 }); ``` ### Technical Analysis The Skill places `cleanText`, `CONFIG.qqAccount`, and `CONFIG.qqTarget` directly into a shell command and executes the result with `child_process.execSync()`. `execSync()` invokes a system shell when given a command string, so shell metacharacters, substitutions, redirections, and command separators are interpreted. Removing the Telegram bot mention does not sanitize shell syntax. The message and target are enclosed in double quotes, but an attacker can inject a double quote to terminate the argument and then append shell commands. The account value is not quoted at all and can also be dangerous if an attacker can influence the process environment. The 30-second timeout limits execution duration but does not prevent arbitrary commands from running. ### Attack Path 1. The bridge runs with access to an OpenClaw agent session. 2. An attacker sends a Telegram message that includes the required `@ollama_openclaw_at_dzt_bot` mention. 3. The message is recorded as a user message in ...[truncated 1453 chars]- Remediation
View remediation