T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/owner-forwarder-demo.mjs:49
- Finding
- Arbitrary Command Execution Through Shell-Based Forwarding Adapter## Vulnerability Details **File Location**: `scripts/owner-forwarder-demo.mjs`, lines 49-55 **Vulnerability Type**: OS command injection through an environment-controlled shell command **Risk Level**: High ```js await new Promise((resolve, reject) => { const child = spawn(OWNER_FORWARD_CMD, { shell: true, stdio: ["pipe", "inherit", "inherit"], env: process.env, }); ``` The command originates from an environment variable at line 8: ```js const OWNER_FORWARD_CMD = String(process.env.OPENCLAW_OWNER_FORWARD_CMD || "").trim(); ``` ### Technical Analysis `OPENCLAW_OWNER_FORWARD_CMD` is passed as a single string to `spawn()` with `shell: true`. Consequently, the operating system shell interprets metacharacters, pipelines, redirections, command substitutions, and chained commands contained in the environment value. The forwarding feature legitimately needs to start an adapter, but shell interpretation is unnecessary. It turns a configuration value into an unrestricted command-execution interface. The child also inherits the complete parent environment through `env: process.env`, potentially exposing credentials and other sensitive configuration to the executed process. Exploitation requires control over, or the ability to influence, the environment used to start the forwarder. A malicious broadcast cannot independently alter this variable, but a qualifying broadcast causes the configured command to execute and can therefore act as the trigger after the environment has been compromised or misconfigured. ### Attack Path 1. An attacker gains the ability to set or modify `OPENCLAW_OWNER_FORWARD_CMD`, such as through a compromised launcher, deployment configuration, service environment, or wrapper script. 2. The attacker supplies a shell expression containing an additional command, redirection, pipeline, or command substitution. 3. The forwarder polls the broadcast endpoint and receives a message containi ...[truncated 927 chars]
- Remediation
- ## Remediation Suggestions - Remove `shell: true` and invoke a trusted executable directly with a separate argument array. - Replace the free-form `OPENCLAW_OWNER_FORWARD_CMD` string with distinct configuration fields such as an absolute executable path and a validated list of arguments. - Allowlist approved adapter executables and reject paths that are relative, writable by untrusted users, or outside trusted installation directories. - Pass a minimal, explicitly constructed environment to the child rather than inheriting all of `process.env`. - Drop unnecessary operating-system privileges before starting the adapter. - Log the selected adapter identity without recording secrets, and fail closed when adapter validation fails. - If flexible command parsing is unavoidable, use a configuration format that represents the executable and each argument separately; do not parse it through a command shell.