T09 · Insecure Skill Coding Practices
Error
- Location
to-do.js:20- Finding
Shell Command Injection in Task Scheduling
- Content
View full analysis
{ exec(command, (error, stdout, stderr) => { resolve({ error, stdout: stdout.trim(), stderr: stderr.trim() }); }); }); } ``` ```js const taskId = `OpenClaw_Task_${Date.now()}`; const flatInstruction = instruction.replace(/\n/g, ' - '); // Quote the binary path in case it contains spaces const winCmd = `schtasks /create /tn "${taskId}" /tr "\\"${OPENCLAW_BIN}\\" agent --message \\\\"${flatInstruction}\\\\" --to \\\\"${userId}\\\\" --channel \\\\"${channel}\\\\" --deliver" /sc ONCE /st ${serverLocal.time} /sd ${serverLocal.date} /f`; const res = await execute(winCmd); ``` ```js const safeInstruction = instruction.replace(/'/g, "'\\''"); const agentCommand = `${OPENCLAW_BIN} agent --message '${safeInstruction}' --to '${userId}' --channel '${channel}' --deliver`; const atCmd = `echo "${agentCommand} >> /tmp/to-do.log 2>&1" | TZ="${tz}" at "${formattedTime}"`; const res = await execute(atCmd); ``` ### Technical Analysis The implementation passes dynamically assembled strings to Node.js `child_process.exec()`, which invokes a command shell. Several values incorporated into these commands are externally controlled or environment-controlled: - Scheduled instruction text - User ID - Channel - Time and timezone - `OPENCLAW_BIN` On Unix, escaping only single quotes in the instruction does not protect the outer double-quoted `echo` argument. Shell expansions such as command substitution using `$()` or backticks can still be interpreted by the shell. The timezone, time, routing fields, and executable path are also interpolated without strict validation. On Windows, backslash-based quote construction does not establish a reliable security bo ...[truncated 1619 chars]- Remediation
View remediation