T08 · Insecure Dependencies
Warning
- Location
- SKILL.md:17
- Finding
- Execution of an Unbundled and Unverified External Wrapper Script## Vulnerability Details **File Location**: `SKILL.md`, lines 17–22 **Vulnerability Type**: `T08: Insecure Dependencies` **Risk Level**: Medium ### Vulnerable Code ```markdown ## How to Use This API (IMPORTANT) To interact with EuroBot, you MUST use the `exec` tool to run the **wrapper script** `~/.openclaw/bin/eurobot-api.sh`. This script handles URL quoting and authentication automatically. **Usage:** `~/.openclaw/bin/eurobot-api.sh METHOD ENDPOINT [JSON_BODY]` ``` ### Technical Analysis The Skill requires the agent to execute `~/.openclaw/bin/eurobot-api.sh`, but this wrapper is not included in the audited project. The project therefore provides no way to verify the script's source, integrity, authentication behavior, destination restrictions, command construction, or handling of the `EUROBOT_AGENT_NAME` environment variable. The use of an absolute path under the user's home directory does not guarantee that the executable is trusted. Any process or user capable of creating or replacing that file could control what runs when the agent follows the Skill. Because the instruction explicitly mandates use of the `exec` tool, the external wrapper becomes part of the Skill's effective implementation despite being outside the review scope. ### Attack Path 1. An attacker or compromised installation process creates or replaces `~/.openclaw/bin/eurobot-api.sh`. 2. A human asks the agent to participate in the EuroBot contest. 3. Following the mandatory instructions in `SKILL.md`, the agent invokes the wrapper through `exec`. 4. The substituted wrapper executes attacker-controlled commands with the permissions of the agent process. 5. The wrapper may read accessible environment values, alter local files, or send contest data and identity information to an unintended network destination. Exploitation depends on the attacker already having a mechanism to place or replace the referenced wrapper. The audited file does not itself ...[truncated 655 chars]
- Remediation
- ## Remediation Suggestions 1. Include the wrapper script in the Skill package so its complete implementation can be reviewed together with `SKILL.md`. 2. Reference the bundled script through a controlled package-relative path rather than an unaudited executable in the user's home directory. 3. Verify the script's integrity before execution using a trusted signature or a cryptographic hash distributed through a protected channel. 4. Restrict network requests to the documented HTTPS origin and reject redirects or unexpected hosts. 5. Construct requests without shell evaluation and pass arguments as discrete values to prevent command injection. 6. Transmit only the environment values required by the API and avoid forwarding the broader agent environment. 7. Apply least-privilege execution controls, including restricted filesystem access, limited outbound networking, and explicit user confirmation for consequential actions. 8. Document the script's provenance, version, update process, and authentication behavior so changes can be independently audited.