T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:72- Finding
Command Injection Through Unvalidated Skill Names, Slugs, and Usernames
- Content
View full analysis
--dry-run ``` ```bash grep -in "AIzaSy\|sk-\|password\|secret\|@gmail\|@qq\|/home/\|192\.168" .//SKILL.md ``` ```bash export PATH="$PATH:$(npm root -g)/.bin" clawhub skill publish ./ \ --slug \ --name "" \ --version ``` ```bash clawhub inspect / ``` Equivalent vulnerable command templates are repeated at lines 234, 248, 265-269, and 276. ### Technical Analysis The workflow collects the skill name and related publication metadata from the user and later inserts those values into shell commands. The placeholders for ``, ``, ``, and `` are not quoted, and the document does not require strict validation before command execution. If an agent performs direct textual substitution, whitespace, shell metacharacters, command substitutions, redirections, or option-like values can change the intended command structure. Quoting `` alone is insufficient because the other user-derived values remain exposed. Quoting must also be paired with validation because command arguments beginning with `-` may still be interpreted as options by invoked programs. The dry-run and privacy-scan commands occur before the stated publication confirmation step. Consequently, requiring confirmation before final publication does not fully mitigate command injection in earlier workflow stages. ### Attack Path 1. An attacker supplies a crafted skill name, slug, username, or version during requirement gathering. 2. The agent generates a directory or co ...[truncated 1472 chars]- Remediation
View remediation