T09 · Insecure Skill Coding Practices
- Location
scripts/owner-forwarder-demo.mjs:49- Finding
Arbitrary Command Execution Through Shell-Based Forwarding Adapter
- Content
View full analysis
Vulnerability Details
File Location:
scripts/owner-forwarder-demo.mjs, lines 49-55
Vulnerability Type: OS command injection through an environment-controlled shell command
Risk Level: Highjs await new Promise((resolve, reject) => { const child = spawn(OWNER_FORWARD_CMD, { shell: true, stdio: ["pipe", "inherit", "inherit"], env: process.env, });The command originates from an environment variable at line 8:
js const OWNER_FORWARD_CMD = String(process.env.OPENCLAW_OWNER_FORWARD_CMD || "").trim();Technical Analysis
OPENCLAW_OWNER_FORWARD_CMDis passed as a single string tospawn()withshell: true. Consequently, the operating system shell interprets metacharacters, pipelines, redirections, command substitutions, and chained commands contained in the environment value.The forwarding feature legitimately needs to start an adapter, but shell interpretation is unnecessary. It turns a configuration value into an unrestricted command-execution interface. The child also inherits the complete parent environment through
env: process.env, potentially exposing credentials and other sensitive configuration to the executed process.Exploitation requires control over, or the ability to influence, the environment used to start the forwarder. A malicious broadcast cannot independently alter this variable, but a qualifying broadcast causes the configured command to execute and can therefore act as the trigger after the environment has been compromised or misconfigured.
Attack Path
- An attacker gains the ability to set or modify
OPENCLAW_OWNER_FORWARD_CMD, such as through a compromised launcher, deployment configuration, service environment, or wrapper script. - The attacker supplies a shell expression containing an additional command, redirection, pipeline, or command substitution.
- The forwarder polls the broadcast endpoint and receives a message containi ...[truncated 927 chars]
- An attacker gains the ability to set or modify
- Remediation
View remediation
Remediation Suggestions
- Remove
shell: trueand invoke a trusted executable directly with a separate argument array. - Replace the free-form
OPENCLAW_OWNER_FORWARD_CMDstring with distinct configuration fields such as an absolute executable path and a validated list of arguments. - Allowlist approved adapter executables and reject paths that are relative, writable by untrusted users, or outside trusted installation directories.
- Pass a minimal, explicitly constructed environment to the child rather than inheriting all of
process.env. - Drop unnecessary operating-system privileges before starting the adapter.
- Log the selected adapter identity without recording secrets, and fail closed when adapter validation fails.
- If flexible command parsing is unavoidable, use a configuration format that represents the executable and each argument separately; do not parse it through a command shell.
- Remove