T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/recipe-to-list.sh:10
- Finding
- Executable dotenv loading permits arbitrary shell execution and overexposes secrets<![CDATA[ ## Vulnerability Details **File Location**: `scripts/recipe-to-list.sh`, lines 10-13 **Vulnerability Type**: Unsafe configuration-file execution and excessive credential propagation **Risk Level**: Medium ### Vulnerable Code ```bash # Load keys/tokens set -a [[ -f ~/.clawdbot/.env ]] && source ~/.clawdbot/.env set +a ``` ### Technical Analysis The wrapper uses the Bash `source` command to load `~/.clawdbot/.env`. This does not parse the file as passive key/value configuration: it executes every statement in the file as shell code under the current user's privileges. The surrounding `set -a` also automatically exports every variable defined by the file. Consequently, unrelated credentials or sensitive configuration values are inherited by the Python process and its `todoist` subprocesses, even though the declared functionality only requires `GEMINI_API_KEY` or `GOOGLE_API_KEY` and `TODOIST_API_TOKEN`. The credential access is broader than the minimum privilege needed by the Skill. The wrapper neither restricts loaded variable names nor validates the file's ownership, permissions, format, or contents. ### Attack Path 1. An attacker, compromised process, malicious installer, or other component obtains write access to `~/.clawdbot/.env`. 2. The attacker inserts a shell statement or command substitution into the file rather than a normal environment assignment. 3. The user invokes `recipe-to-list.sh`. 4. Bash evaluates the entire file through `source`. 5. The injected commands execute with the invoking user's permissions. 6. All values loaded while `set -a` is active are also exposed to the Python process and subsequently launched child processes. This path requires the attacker to be able to create or modify the referenced dotenv file, but the wrapper converts that otherwise passive configuration access into a direct execution primitive. ### Impact Assessment Successful exploitation permits arbitrary command execution with the privileges of th ...[truncated 413 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not use `source`, `.`, `eval`, or command substitution to parse dotenv files. - Prefer requiring the caller to provide the three documented environment variables directly. - If dotenv support is necessary, use a strict parser that accepts only allowlisted key/value assignments: - `GEMINI_API_KEY` - `GOOGLE_API_KEY` - `TODOIST_API_TOKEN` - Reject shell operators, substitutions, functions, redirections, and additional variable names. - Validate that the dotenv file is owned by the current user and is not writable by group or other users. - Avoid `set -a`; construct an explicit, minimal environment for Python and child processes. - In Python, invoke Todoist with an allowlisted environment rather than inheriting the full parent environment. - Document the credential-loading behavior and provide a mode that does not read any home-directory credential file. ]]>