T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/setup.sh:15- Finding
Unescaped Agent Name Allows JSON Request-Body Injection
- Content
View full analysis
/dev/null || echo "") fi [ -z "$AGENT_NAME" ] && AGENT_NAME=$(hostname | tr '[:upper:]' '[:lower:]' | sed 's/[^a-z0-9]/-/g') echo "🤖 Registering $AGENT_NAME on HeartAI..." RESPONSE=$(curl -s -w "\n%{http_code}" -X POST "$HEARTAI_URL/api/agents/register" \ -H "Content-Type: application/json" \ -d "{\"agentName\": \"$AGENT_NAME\", \"description\": \"OpenClaw Agent\"}") ``` ### Technical Analysis The script obtains `AGENT_NAME` from the `OPENCLAW_AGENT_NAME` environment variable or the local `~/.openclaw/config.yaml` file and directly interpolates it into a JSON string. It does not apply JSON escaping or enforce an allowlist before constructing the request. An agent name containing quotation marks, backslashes, or JSON structural characters can terminate the intended string and add or alter properties in the registration payload. Shell command injection is not established because the expansion occurs inside a quoted shell argument; however, JSON request-body injection and malformed-request denial of service are possible. For example, an agent name shaped like: ```text name", "description": "attacker-controlled ``` would cause the script to construct a request body whose semantic content differs from the fixed registration object intended by the developer, subject to how the receiving server handles duplicate or modified properties. ### Attack Path 1. An attacker gains the ability to set `OPENCLAW_AGENT_NAME` in the setup process environment or modify the current user's `~/.openclaw/config.yaml`. 2. The attacker su ...[truncated 1110 chars]- Remediation
View remediation
/dev/null 2>&1; then echo "❌ jq is required to construct the registration request safely." exit 1 fi if [[ ! "$AGENT_NAME" =~ ^[a-zA-Z0-9._-]{1,64}$ ]]; then echo "❌ Invalid agent name." exit 1 fi PAYLOAD=$(jq -n \ --arg agentName "$AGENT_NAME" \ --arg description "OpenClaw Agent" \ '{agentName: $agentName, description: $description}') RESPONSE=$(curl --silent --show-error \ -w "\n%{http_code}" \ -X POST "$HEARTAI_URL/api/agents/register" \ -H "Content-Type: application/json" \ --data-binary "$PAYLOAD") ``` Apply the following additional hardening measures: 1. Enforce a documented allowlist and maximum length for agent names. 2. Use a YAML-aware parser rather than `grep` when reading `config.yaml`. 3. Reject control characters and unexpected multiline values. 4. Keep server-side schema validation enabled so unknown properties, malformed names, and duplicate sensitive fields are rejected. 5. Add tests covering quotation marks, backslashes, newlines, Unicode characters, oversized values, and attempted JSON-property injection. ]]>