T09 · Insecure Skill Coding Practices
Error
- Location
scripts/validate.sh:159- Finding
Unrestricted Execution of Untrusted Skill Scripts
- Content
View full analysis
/dev/null | head -1) if [ -n "$first_script" ] && [ -f "$first_script" ]; then # 空参数测试 output=$($first_script 2>&1) && result=0 || result=$? ``` At lines 194–195, a target Skill's diagnostic script is executed through Bash: ```bash if [ -f "$SKILL_PATH/scripts/diagnose.sh" ]; then output=$(bash "$SKILL_PATH/scripts/diagnose.sh" 2>&1 | head -5) ``` ### Technical Analysis The validator treats scripts from the Skill being audited as executable test cases. It runs them without: - Process or filesystem sandboxing - Privilege reduction - Network isolation - Execution timeout - CPU, memory, process, or output limits - Removal of secrets from the environment - User confirmation - Prior static security review A Skill is precisely the component whose trustworthiness is being evaluated. Its scripts must therefore be considered attacker-controlled until validation is complete. Executing those scripts in the validator's own security context violates this trust boundary and turns validation into an arbitrary code-execution mechanism. Piping the diagnostic script's output through `head -5` does not constrain the script itself. The shell still launches the script normally, and it can perform arbitrary side effects before, during, or after producing output. The base directory is hard-coded as `/root/.openclaw/workspace/skills`, indicating that the validator may run in a root-owned environment. If invoked with root privileges, the target script inherits those privileges. In addition, `SKILL_NAME` is appended directly to the base directory: ```bash SKILL_NAME=$1 SKILL_PATH="$SKILL_DIR/$SKILL_NAM ...[truncated 2213 chars]- Remediation
View remediation