T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:78- Finding
Shell Command Injection Through an Unvalidated Mirror URL
- Content
View full analysis
" -o /tmp/wechat-article.html ``` Verify file size > 10KB (smaller usually means redirect/error page). ``` ### Technical Analysis The workflow instructs the Agent to take a mirror URL obtained from web-search results and interpolate it directly into a shell command executed through the `exec` tool. The URL is enclosed in double quotes, but double quotes do not neutralize all shell syntax. If an attacker-controlled value can terminate the quoted argument or introduce command substitution, shell operators may be evaluated by the command interpreter. The instructions do not require URL parsing, hostname allowlisting, shell metacharacter rejection, or a structured process API that passes arguments without shell interpretation. Search poisoning, a compromised mirror, or an unexpectedly crafted search-result URL could therefore turn a content-download operation into arbitrary local command execution. ### Attack Path 1. An attacker creates or compromises a page likely to appear in mirror-search results for a targeted WeChat article. 2. The attacker causes the discovered mirror URL to contain shell-significant content or otherwise supplies a crafted URL to the workflow. 3. The Agent selects that search result as the mirror URL. 4. The Agent substitutes the untrusted value into: `curl -s -L "" -o /tmp/wechat-article.html` 5. The `exec` tool invokes the command through a shell. 6. The shell evaluates the injected syntax, executing attacker-selected commands in addition to or instead of `curl`. ### Impact Assessment Successful exploitation could execute arbitrary commands with the operating-system privileges of the Agent or OpenClaw process. Depending on that accou ...[truncated 546 chars]- Remediation
View remediation