T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:20- Finding
Shell Command Injection Through Unsafe Task Interpolation
- Content
View full analysis
"` ``` `SKILL.md:31-32`: ```markdown ### Long-running background task 1. Start with `exec(background:true, pty:true, workdir, command:"codex exec ...")` ``` `references/codex-usage-recipes.md:4-8`: ```markdown ## 1) Quick implementation - Tool: `exec` - Params: - `pty:true` - `workdir:/path/to/repo` - `command:"codex exec \"Implement X and add tests\""` ``` `references/codex-usage-recipes.md:10-14`: ```markdown ## 2) Code review pass - Tool: `exec` - Params: - `pty:true` - `workdir:/path/to/repo` - `command:"codex exec \"Review current changes and list critical issues\""` ``` `references/codex-usage-recipes.md:17-20`: ```markdown ## 3) Long task with monitoring - Start: - `exec(background:true, pty:true, workdir, command:"codex exec \"...\"")` ``` ### Technical Analysis The skill instructs the agent to construct an `exec.command` string by placing a task inside double quotes. The task can originate from an untrusted user request. Double quotes do not neutralize shell command substitution, and an attacker can also terminate the quoted argument and append additional shell commands. For example, if a task is interpolated without robust shell escaping: ```text "; id > /tmp/codex-injection-proof; # ``` the resulting command can become: ```bash codex exec ""; id > /tmp/codex-injection-proof; #" ``` The shell treats `id > /tmp/codex-injection-proof` as a separate command. Other shell constructs, including command substitution such as `$(command)`, may remain active inside double quotes depending on how the execution tool inv ...[truncated 1987 chars]- Remediation
View remediation
" ``` 3. **If only a shell command string is supported, apply robust shell escaping.** Quote every argument using a well-tested shell-escaping library. Do not implement escaping through simple quote replacement or rely solely on double quotes. 4. **Prefer the bundled wrapper script after validating its path and permissions.** Invoke it with separately represented arguments where possible. Preserve the existing quoted expansions: ```bash cd "$PROJECT_DIR" codex exec "$TASK" ``` 5. **Validate repository paths independently.** Resolve the requested working directory to a canonical path and enforce an allowlist or approved workspace boundary before execution. 6. **Apply least privilege and sandboxing.** Run Codex and OpenClaw with only the repository access required for the task. Restrict access to credentials, home-directory secrets, unrelated repositories, and unnecessary network destinations. 7. **Add adversarial tests.** Verify that task strings containing characters and constructs such as `"`, `'`, `;`, `&&`, `|`, backticks, `$()`, newlines, and redirections are delivered to Codex as one literal argument and never interpreted by a shell. 8. **Update every documented execution pattern.** Correct both `SKILL.md` and `references/codex-usage-recipes.md` so agents are not directed back to the unsafe string-interpolation pattern. ]]>