Terminal Executor

• Outcome: Review
• Latest audit: Sep 11, 2026 · 7:15 AM UTC
• Version: 1.0.1

Overview

This skill is a disclosed terminal runner, but it can run arbitrary commands, including sudo commands, without strong built-in controls.

Review carefully before installing. This skill should only be used in a tightly controlled environment where you expect an agent to run shell commands, and especially sudo commands. Avoid using it with untrusted prompts, shared machines, sensitive environment variables, passwordless sudo, or broad filesystem access unless additional approval, sandboxing, and command restrictions are added.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: tools/exec.js:5

Finding

Unrestricted Shell Command Execution Through Caller-Controlled Input

Content

View full analysis

Vulnerability Details

File Location: tools/exec.js, lines 5-11
Vulnerability Type: OS command injection and unrestricted shell execution
Risk Level: High

Vulnerable Code

js

module.exports = async (command, options = {}) => {
  try {
    const { stdout, stderr } = await execAsync(command, {
      cwd: options.cwd || process.cwd(),
      env: { ...process.env, ...options.env },
      timeout: options.timeout || 30000
    });

Technical Analysis

The exported tool passes the caller-controlled command string directly to Node.js child_process.exec. This API executes the supplied string through a system shell, so shell operators and constructs such as command chaining, pipelines, redirects, variable expansion, and command substitution are interpreted.

No executable allowlist, argument validation, shell-metacharacter rejection, authorization check, or confirmation mechanism is implemented. The caller may also override the working directory and add or replace environment variables. Although SKILL.md states that sensitive operations require confirmation, this requirement is not enforced by the code.

Attack Path

1. An attacker directly supplies, or causes prompt-injected content to influence, the command tool argument.
2. The Agent invokes the exported exec tool with the attacker-influenced string.
3. execAsync passes that string to a system shell without validation.
4. The shell interprets all included commands, substitutions, redirects, and chained operations.
5. The commands execute with the operating-system privileges of the process hosting the Skill.

For example, input presented as a benign diagnostic command could append an additional command through shell chaining. No second authorization boundary prevents execution of the appended operation.

Impact Assessment

Successful exploitation permits arbitrary command execution with the privileges of the host Agent ...[truncated 370 chars]

Remediation

View remediation

Remediation Suggestions

• Replace child_process.exec with execFile or spawn using a fixed executable and a separately constructed argument array.
• Define a narrow allowlist of permitted executables and validate every argument against command-specific rules.
• Do not accept arbitrary shell syntax. Reject shell metacharacters, redirects, substitutions, and command separators if shell execution cannot be completely removed.
• Require explicit, independently verified user approval before any destructive, sensitive, or state-changing operation.
• Restrict cwd to approved directories and prevent arbitrary environment-variable overrides.
• Run the Skill in a sandboxed, least-privileged account with constrained filesystem and network access.
• Add security tests covering command chaining, command substitution, redirects, malicious environment values, and unauthorized working directories.

T09 · Insecure Skill Coding Practices

Error

• Location: tools/sudo_exec.js:5

Finding

Unrestricted Privileged Command Execution Through Sudo

Content

View full analysis

Vulnerability Details

File Location: tools/sudo_exec.js, lines 5-12
Vulnerability Type: Privileged OS command injection
Risk Level: Critical

Vulnerable Code

js

module.exports = async (command, options = {}) => {
try {
const fullCommand = `sudo ${command}`;
const { stdout, stderr } = await execAsync(fullCommand, {
cwd: options.cwd || process.cwd(),
env: { ...process.env, ...options.env },
timeout: options.timeout || 60000
});

Technical Analysis

The function interpolates an unrestricted caller-controlled string into sudo ${command} and executes the result through child_process.exec. Because a shell processes the resulting string, the caller can select the privileged program and its arguments and can use shell syntax to compose additional operations.

The implementation does not enforce an allowlist, constrain arguments, verify that the requested privilege is necessary, or obtain explicit approval for the exact privileged action. It also does not invoke sudo in a mode that reliably prevents interactive authentication. If the host has passwordless sudo rules or cached sudo authorization, attacker-selected operations may execute with root privileges immediately.

The documentation's statement that sensitive operations require user confirmation is only advisory and has no corresponding enforcement in this function.

Attack Path

1. An attacker directly controls, or indirectly influences through prompt injection, the argument supplied to sudo_exec.
2. The function concatenates that input after the sudo prefix.
3. The combined string is passed to execAsync, which invokes a system shell.
4. The shell and sudo process the attacker-selected command and arguments.
5. If applicable sudo authorization is available, the selected operation executes with elevated privileges.
6. The attacker can then modify root-controlled resources, access protected data, or perform destructiv ...[truncated 752 chars]

Remediation

View remediation

Remediation Suggestions

• Remove the general-purpose sudo_exec interface and replace it with narrowly scoped privileged operations.
• Use a root-owned privilege broker that exposes only explicitly approved actions with strict, typed parameters.
• If invoking sudo remains necessary, call a fixed executable with execFile or spawn and a validated argument array; never construct a shell command by string interpolation.
• Configure exact command-specific sudoers rules rather than broad passwordless sudo access.
• Use non-interactive sudo behavior so authorization failures fail closed instead of prompting or hanging.
• Require explicit user confirmation that displays the exact executable, arguments, affected resources, and privilege level before execution.
• Block destructive operations by default and apply least-privilege, filesystem, process, and network sandboxing.
• Record privileged operations in tamper-resistant audit logs while redacting credentials and sensitive output.
• Replace the real sudo apt update call in test.js with a mocked privileged executor or a harmless isolated test.

SkillSpector

Vulnerability Patterns

• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (13)

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 98% confidence

Finding

The function prepends sudo to an arbitrary caller-supplied command and executes it through child_process.exec, which invokes a shell. This creates a high-risk privilege-escalation path because untrusted input can become root-level shell execution, and there is no confirmation, policy check, or command allowlist to limit dangerous operations.

Content

No source excerpt is available for this finding.

Natural-Language Policy Violations

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

All user-facing natural-language content in the skill file is written in Chinese, and the document does not indicate that language selection is optional or region-specific. Under the stated policy, forcing a specific language without user opt-in is a natural-language policy concern.

Content

No source excerpt is available for this finding.

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation condition is broad enough to trigger this skill for many ordinary requests involving system help, software installation, or status checks, which increases the chance the agent will route users into direct command execution unnecessarily. In this skill, that risk is amplified because the available tools include both arbitrary command execution and sudo execution, so over-triggering can lead to unintended high-privilege actions from ambiguous user requests.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 93% confidence

Finding

This skill explicitly exposes a sudo_exec tool and advertises 'sudo support', which enables command execution with elevated privileges. In an agent skill context, that materially increases the blast radius of any prompt injection, command injection, or misuse, allowing system-wide modification, data access, or destructive actions well beyond normal user permissions.

Content

Scanner excerpt · index.js (reported line 4)May include surrounding context.

js

module.exports = {
name: 'terminal-executor',
version: '1.0.0',
description: 'Execute terminal commands with sudo support',
tools: {
exec: require('./tools/exec'),
sudo_exec: require('./tools/sudo_exec')

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 84% confidence

Finding

Advertising sudo/root command execution as a supported capability materially increases the risk of privilege abuse, destructive system changes, and persistence if the skill is invoked improperly or manipulated through prompt/context confusion. Even in metadata, this signals that the skill is designed to enable privileged operations, which is dangerous unless tightly constrained by policy, allowlisting, and explicit approvals.

Content

Scanner excerpt · package.json (reported line 4)May include surrounding context.

json

{
"name": "@openclaw/terminal-executor",
"version": "1.0.0",
"description": "Execute terminal commands with sudo support",
"main": "index.js",
"scripts": {
"test": "echo \"Error: no test specified\" && exit 1"

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The activation condition is broad enough to trigger this skill for many ordinary requests involving system commands or software installation. In a skill that exposes both exec and sudo_exec capabilities, overbroad activation increases the chance of unintended selection and execution of sensitive commands without sufficient user intent validation.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 95% confidence

Finding

Advertising sudo/root execution as a built-in capability creates a direct path to privileged system modification if the skill is invoked on untrusted or ambiguous input. In the context of a broadly activated terminal executor, this substantially increases the risk of privilege abuse, system compromise, data loss, or persistence by allowing dangerous commands to run with elevated permissions.

Content

Scanner excerpt · skill.json (reported line 4)May include surrounding context.

json

{
"name": "terminal-executor",
"version": "1.0.0",
"description": "Execute terminal commands with sudo support",
"tools": ["exec", "sudo_exec"],
"activation": "When user needs to run system commands"
}

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The activation condition is so broad that it can trigger for many ordinary requests involving system commands, increasing the chance this skill is selected in contexts where privileged command execution is unnecessary or unsafe. Because the skill exposes both command execution and sudo-capable execution, overly loose activation expands the attack surface and can enable prompt-driven misuse or accidental destructive actions.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code invokes a privileged shell command via sudo_exec("apt update") without any user-facing warning, confirmation, or indication of elevated privileges. Even though the command shown is a common maintenance operation, executing privileged commands silently is dangerous because it normalizes hidden elevation and could enable unintended system changes or be swapped for more harmful commands later.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

This code executes an arbitrary shell command supplied via the command parameter using child_process.exec, which invokes a shell and exposes the application to command injection and arbitrary command execution if untrusted input reaches this function. In a reusable agent skill, this is especially dangerous because the helper provides no validation, allowlist, prompting, or safety boundary before running OS commands.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The subprocess inherits the full parent environment via { ...process.env, ...options.env }, which can expose sensitive secrets such as API keys, tokens, and credentials to any executed command. If an attacker can influence the command or cause a malicious binary/script to run, those inherited environment variables can be read and exfiltrated.

Content

No source excerpt is available for this finding.

Sudo/Root Execution

Medium

• Category: Privilege Escalation
• Confidence: 99% confidence

Finding

The explicit use of sudo shows the helper is designed to execute commands with elevated privileges. In this skill context, that is especially dangerous because the module accepts arbitrary command input and provides a reusable primitive for root-level system modification, making abuse or accidental damage far more severe than normal command execution.

Content

Scanner excerpt · tools/sudo_exec.js (reported line 7)May include surrounding context.

js

module.exports = async (command, options = {}) => {
try {
const fullCommand = `sudo ${command}`;
const { stdout, stderr } = await execAsync(fullCommand, {
cwd: options.cwd || process.cwd(),
env: { ...process.env, ...options.env },

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 95% confidence

Finding

The code forwards merged environment variables into a privileged subprocess via env: { ...process.env, ...options.env }. Passing attacker-controlled or unnecessary environment values into a sudo-invoked command can influence program behavior, expose secrets, or interact dangerously with sudo/environment handling, especially when combined with root execution.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.