T09 · Insecure Skill Coding Practices
Error
- Location
scripts/build.sh:264- Finding
Arbitrary Command Execution Through Configured Build Commands
- Content
View full analysis
&2 if ! eval "$test_command" >&2 2>&1; then tests_passed=false errors+=("Test command failed: $test_command") fi fi # Run lint command if [[ -n "$lint_command" ]]; then echo "Running lint: $lint_command" >&2 if ! eval "$lint_command" >&2 2>&1; then lint_passed=false errors+=("Lint command failed: $lint_command") fi fi # Run build command if [[ -n "$build_command" ]]; then echo "Running build: $build_command" >&2 if ! eval "$build_command" >&2 2>&1; then build_passed=false errors+=("Build command failed: $build_command") fi fi ``` ### Technical Analysis The `test_command`, `lint_command`, and `build_command` values are read from `.specclaw/config.yaml` and passed directly to Bash `eval`. Unlike execution through a fixed command and argument array, `eval` reparses the complete value as shell syntax. Shell separators, substitutions, redirections, pipelines, and additional commands are therefore executed. This is dangerous when SpecClaw is initialized in an untrusted repository, when a pull request can alter `.specclaw/config.yaml`, or when an agent-generated change modifies that configuration. The build finalization flow treats the values as project configuration but does not require user confirmation, validate them against an allowlist, or isolate their execution. The commands execute with the privileges and environment of the OpenClaw process. They may consequently access repository files, environment variables, local credentials available to that account, and network resources. ### Attack Path 1. An attacker contributes or modifies `.specclaw/config.yaml`. 2. The attacker sets a build field to shell syntax, for example: ```yaml ...[truncated 902 chars]- Remediation
View remediation