T09 · Insecure Skill Coding Practices
Error
- Location
scripts/update-progress.sh:11- Finding
Arbitrary JavaScript Execution Through Unescaped Shell Variable Interpolation
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi TIPS_FILE="$TIPS_FILE" DAY="$DAY" DATE="$DATE" node <<'NODESCRIPT' const fs = require('fs'); const path = require('path'); const tipsFile = process.env.TIPS_FILE; const day = Number.parseInt(process.env.DAY, 10); const date = process.env.DATE; if (!Number.isInteger(day) || day < 1 || day > 7) { throw new Error('Invalid day'); } if (!/^\d{4}-\d{2}-\d{2}$/.test(date)) { throw new Error('Invalid date'); } // Continue state processing using these values as data. NODESCRIPT ``` Additional hardening measures: 1. Validate that the date is both syntactically valid and represents a real calendar date. 2. Treat `OPENCLAW_HOME` as untrusted configuration and resolve it to an expected absolute directory. 3. Reject unexpected control characters in paths and arguments. 4. Avoid embedding any environment-derived value into generated source code. 5. Add regression tests containing quotes, backslashes, newlines, JavaScript syntax, and shell metacharacters. 6. Run the Skill with only the filesystem and network privileges required for reminder operation. ]]>