T09 · Insecure Skill Coding Practices
- Location
scripts/porkbun.sh:11- Finding
Arbitrary Command Execution Through Unsafe .env Evaluation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/porkbun.sh, lines 11–14
Vulnerability Type: Shell command injection through unsafe configuration parsing
Risk Level: Highbash if [ -z "${PORKBUN_API_KEY:-}" ]; then ENV_FILE="${OPENCLAW_WORKSPACE:-$HOME/.openclaw/workspace}/.env" if [ -f "$ENV_FILE" ]; then eval "$(grep '^PORKBUN_' "$ENV_FILE" | sed 's/^/export /')" fi fiTechnical Analysis
The script loads credential assignments from a workspace
.envfile and passes them toeval. Althoughgrep '^PORKBUN_'restricts matching lines by prefix, it does not make their contents safe. Shell substitutions, command separators, redirections, and other shell syntax within a matching assignment are interpreted as executable code.For example, a matching line can contain command substitution:
bash PORKBUN_API_KEY=$(attacker-controlled-command)When the script executes
eval, the embedded command runs with the permissions of the user or Agent invoking the Skill. TheOPENCLAW_WORKSPACEenvironment variable can also change which.envfile is selected, increasing the risk where that variable or the selected workspace is attacker-controlled.Executing configuration data as shell code is unnecessary for the declared credential-loading functionality and exceeds the minimum behavior needed to read the two Porkbun keys.
Attack Path
- An attacker gains the ability to create or modify the
.envfile under the selected workspace, or influencesOPENCLAW_WORKSPACEso it points to an attacker-controlled directory. - The attacker inserts a line beginning with
PORKBUN_that contains shell syntax, such as command substitution. - The victim invokes any
porkbun.shoperation whilePORKBUN_API_KEYis absent from the existing process environment. - The script reads the malicious line and supplies it to
eval. - The injected command executes before the requested Porkbun API operation proceeds.
Impact Assessment
S ...[truncated 823 chars]
- An attacker gains the ability to create or modify the
- Remediation
View remediation
Remediation Suggestions
- Remove
evalentirely and treat.envcontents strictly as data. - Prefer requiring
PORKBUN_API_KEYandPORKBUN_SECRET_KEYthrough the process environment or a dedicated secret manager. - If
.envsupport is required, parse only the two exact variable names with a strict parser that does not interpret shell syntax. - Reject malformed assignments, duplicate keys, command substitutions, expansions, redirections, and unexpected control characters.
- Avoid allowing an untrusted
OPENCLAW_WORKSPACEvalue to select the credential file. Resolve the path against an approved workspace root where possible. - Verify that the credential file is a regular file, is not an unexpected symbolic link, and has restrictive ownership and permissions.
- Export parsed values without reevaluation. A safer implementation pattern is:
bash ENV_FILE="${OPENCLAW_WORKSPACE:-$HOME/.openclaw/workspace}/.env" if [ -z "${PORKBUN_API_KEY:-}" ] && [ -f "$ENV_FILE" ]; then while IFS='=' read -r key value; do case "$key" in PORKBUN_API_KEY|PORKBUN_SECRET_KEY) case "$value" in *'$('*|*'`'*|*';'*|*'&'*|*'|'*|*'<'*|*'> '*) printf 'Unsafe value for %s\n' "$key" >&2 exit 1 ;; esac printf -v "$key" '%s' "$value" export "$key" ;; esac done < "$ENV_FILE" fiA vetted dotenv parser or secret-management facility is preferable to maintaining custom parsing logic.
- Remove