T09 · Insecure Skill Coding Practices
Error
- Location
scripts/cron-edit-safe.sh:167- Finding
Predictable Shared Temporary Files Allow Local File Clobbering and Information Disclosure
- Content
View full analysis
/tmp/cron-dry-run.out 2>&1 && DRY_RUN_OK=1 || DRY_RUN_OK=0 else timeout 60 bash -c "$DRY_RUN_CMD" >/tmp/cron-dry-run.out 2>&1 && DRY_RUN_OK=1 || DRY_RUN_OK=0 fi if [[ $DRY_RUN_OK -eq 1 ]]; then ok "Dry-run OK (exit 0)" log " 摘要: $(head -3 /tmp/cron-dry-run.out | tr '\n' ' ')" else err "Dry-run FAILED (exit non-zero)" log " 完整输出: /tmp/cron-dry-run.out" log " 前 5 行:" head -5 /tmp/cron-dry-run.out | sed 's/^/ /' fi ``` ```bash if openclaw cron edit "$CRON_ID" "${EDIT_ARGS[@]}" >/tmp/cron-edit.out 2>&1; then ok "Edit OK" else err "Edit FAILED" log " 输出: /tmp/cron-edit.out" EDIT_FAILED=1 fi ``` ```bash if openclaw cron get "$CRON_ID" >/tmp/cron-after.json 2>&1; then python3 -c " import json with open('/tmp/cron-after.json', 'r') as f: content = f.read() idx = content.find('{') if idx < 0: print('NO_JSON') else: d = json.loads(content[idx:]) print(f'payload.kind={d[\"payload\"][\"kind\"]}') argv = d['payload'].get('argv', []) if argv: print(f'argv=[\"{\" \".join(argv)}]') else: print('argv=[]') print(f'name={d[\"name\"]}') print(f'enabled={d.get(\"enabled\", \"?\")}') " > /tmp/cron-after-extract.txt 2>&1 fi ``` ```bash if openclaw cron edit "$CRON_ID" "${ROLLBACK_ARGS[@]}" >/tmp/cron-rollback.out 2>&1; then ok "Rollback OK: 已恢复 $CRON_ID 到原始状态" fi ``` ### Technical Analysis The script repeatedly writes potentially sensitive or privileged process output to fixed filenames in the globally writable `/tmp` directory. Shell redirection opens these paths without securely creating them, checking ownership, rejecting symbolic links, or applying explici ...[truncated 2144 chars]- Remediation
View remediation