T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:73- Finding
Shell Command Injection Through Dynamic Recovery Log Content
- Content
View full analysis
| <错误类型>" >> ~/claw_recovery.log ``` `i18n/en.md:75`: ```bash echo "[$(date)] | " >> ~/claw_recovery.log ``` `references/feedback-templates.md:55`: ```bash echo "[$(date)] 权限错误恢复：<操作描述> | <错误类型>" >> ~/claw_recovery.log ``` `i18n-en-references/feedback-templates.md:56`: ```bash echo "[$(date)] Permission error recovery: | " >> ~/claw_recovery.log ``` ### Technical Analysis The recovery workflow instructs the Agent to place an operation description and error type directly into a shell command. These values may contain content derived from a user's instruction, a file name, tool output, or an error message. If the Agent performs textual placeholder substitution and executes the resulting command as shell source, shell metacharacters in the inserted content will be interpreted. Double quotes do not disable command substitution through constructs such as `$(command)` or backticks. For example, an operation description containing: ```text process $(malicious_command) ``` could produce: ```bash echo "[$(date)] Permission error recovery: process $(malicious_command) | permission denied" >> ~/claw_recovery.log ``` The shell would execute `malicious_command` before writing the resulting log entry. The vulnerable behavior is conditional on the Agent interpolating untrusted text into the command source, but that is the natural implementation implied by the documented placeholders. ### Attack Path 1. An attacker submits a task whose description, target name, or other logged content contains shell command-substitution syntax. 2. The task encoun ...[truncated 1324 chars]- Remediation
View remediation
> "$HOME/claw_recovery.log" ' sh "$operation" "$error_type" ``` The execution layer must pass `operation` and `error_type` as distinct argument values rather than concatenating them into the command string. 4. **Normalize log content.** Remove carriage returns, newlines, and control characters to prevent log forging and multiline injection. 5. **Apply size limits.** Truncate operation descriptions and error messages to a reasonable maximum length before logging. 6. **Restrict log-file permissions.** Create `~/claw_recovery.log` with owner-only access where supported, such as mode `0600`. 7. **Update all localized copies consistently.** Apply the same safe logging guidance to: - `SKILL.md` - `i18n/en.md` - `references/feedback-templates.md` - `i18n-en-references/feedback-templates.md` ]]>