T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/clawmind.sh:57
- Finding
- Arbitrary Local Code Execution Through Python Source Injection<![CDATA[ ## Vulnerability Details **File Location**: `scripts/clawmind.sh:57`, `scripts/clawmind.sh:88-92`, `scripts/clawmind.sh:137`, and `scripts/clawmind.sh:156` **Vulnerability Type**: Python source injection through unsafe interpolation of command-line arguments **Risk Level**: High ### Vulnerable Code ```bash curl -s "$BASE_URL/search?q=$(python3 -c "import urllib.parse; print(urllib.parse.quote('$QUERY'))")&type=all&limit=10" \ -H "$(auth_header)" | python3 -m json.tool ``` ```bash TAGS_JSON="[]" if [[ -n "$TAGS" ]]; then TAGS_JSON=$(python3 -c "import json; print(json.dumps('$TAGS'.split(',')))") fi TECH_JSON="[]" if [[ -n "$TECH" ]]; then TECH_JSON=$(python3 -c "import json; print(json.dumps('$TECH'.split(',')))") fi ``` ```bash TAGS_JSON="[]" if [[ -n "$TAGS" ]]; then TAGS_JSON=$(python3 -c "import json; print(json.dumps('$TAGS'.split(',')))") fi ``` ```bash python3 -c "import json; print(json.dumps({'body': '$BODY'}))" | \ curl -s -X POST "$BASE_URL/questions/$SLUG/answers" \ -H "$(auth_header)" \ -H "Content-Type: application/json" \ -d @- | python3 -m json.tool ``` ### Technical Analysis The `search`, `create-pattern`, `ask`, and `answer` command implementations interpolate untrusted shell arguments directly into source code passed to `python3 -c`. Shell quoting does not make these values safe Python literals. An argument containing a single quote can terminate the intended Python string. Additional Python expressions or statements can then be inserted into the generated program. When Python evaluates the resulting source, the injected code runs with the same operating-system privileges as the user invoking the Skill. This is particularly dangerous for an agent-facing Skill because arguments may originate from remote ClawMind content, copied examples, or other untrusted text. If such content is passed to one of the affected commands without strict validation, it crosses from data into executable Python source. The multi-lin ...[truncated 2097 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Never embed user-controlled values into source passed to `python3 -c`. Pass values as positional arguments or through standard input. Replace the search encoding logic with: ```bash ENCODED_QUERY=$( python3 -c 'import sys, urllib.parse; print(urllib.parse.quote(sys.argv[1]))' "$QUERY" ) curl -s "$BASE_URL/search?q=$ENCODED_QUERY&type=all&limit=10" \ -H "$(auth_header)" | python3 -m json.tool ``` Build comma-separated arrays without source interpolation: ```bash TAGS_JSON=$( python3 -c 'import json, sys; print(json.dumps(sys.argv[1].split(",") if sys.argv[1] else []))' "$TAGS" ) TECH_JSON=$( python3 -c 'import json, sys; print(json.dumps(sys.argv[1].split(",") if sys.argv[1] else []))' "$TECH" ) ``` Build answer JSON safely: ```bash python3 -c 'import json, sys; print(json.dumps({"body": sys.argv[1]}))' "$BODY" | \ curl -s -X POST "$BASE_URL/questions/$SLUG/answers" \ -H "$(auth_header)" \ -H "Content-Type: application/json" \ -d @- | python3 -m json.tool ``` Apply the same rule consistently to every value: source code must remain constant, while untrusted values must be supplied exclusively through `sys.argv`, standard input, or a dedicated JSON-generation mechanism. Add regression tests using inputs containing single quotes, double quotes, semicolons, backslashes, newlines, Unicode, and Python-looking expressions. Tests should verify that such values remain inert data and cannot create files, start processes, or access credentials. ]]>