T09 · Insecure Skill Coding Practices
- Location
SKILL.md:493- Finding
Unsanitized User-Controlled Values Used in Shell Commands and Filesystem Paths
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 207, 258, 414, and 493–500
Vulnerability Type: Command injection and path traversal
Risk Level: HighVulnerable Code
markdown - Project ID (lowercase, hyphens or underscores, used in folder names — e.g., "ezbi")markdown - If a git repo: SSH URL(s) for cloningmarkdown This creates the entire project at `~/.openclaw/projects/[project-id]/`.markdown **Shared medium initialization:** - Git repo: `cd ~/.openclaw/projects/[project-id]/workspace && git clone [ssh-url] [repo-name]` - Folder/Drive: create `workspace/[folder-name]/` and add a `LINKS.md` file with the external URL if not local - CRM/external: skip — write a `workspace/EXTERNAL_SYSTEM.md` describing where work happens - None: skip **Media folder** — only if Pass 2 #7 was yes: ```bash mkdir -p ~/.openclaw/projects/[project-id]/workspace/[media-folder-name]text ### Technical Analysis The Skill directs an agent to collect project identifiers, repository URLs, repository names, and folder names from the user and interpolate them into shell commands and filesystem paths. Although line 207 informally describes the expected project-ID format, the Skill does not require programmatic validation, canonicalization, shell-safe argument handling, or containment checks before these values are used. The command on line 493 places `[project-id]`, `[ssh-url]`, and `[repo-name]` into a shell command. If an implementation follows this instruction through a shell, metacharacters in any substituted value could alter command structure. The `mkdir` command on line 500 has the same issue for `[project-id]` and `[media-folder-name]`. Separately, path components containing `../`, path separators, absolute paths, or other special values could escape the intended `~/.openclaw/projects/[project-id]/` directory. Values beginning with `-` may also be interpreted as command options where an end-of-options marker is n ...[truncated 1638 chars]- Remediation
View remediation
Remediation Suggestions
-
Enforce strict allow-list validation before using identifiers as path components:
- Project IDs, role keys, repository destination names, and media folder names should match a rule such as
^[a-z0-9][a-z0-9_-]*$. - Reject
..,/,\, control characters, leading hyphens, shell metacharacters, and empty values.
- Project IDs, role keys, repository destination names, and media folder names should match a rule such as
-
Avoid constructing shell command strings. Invoke executables through structured process APIs with argument arrays, for example:
- Executable:
git - Arguments:
["clone", "--", validatedUrl, validatedDestination] - Working directory: a separately validated workspace path.
- Executable:
-
Use native filesystem APIs for directory creation instead of interpolated
mkdircommands. -
Canonicalize every destination path and verify that it remains beneath the canonical project root before creating or writing files.
-
Validate repository origins separately. Permit only supported SSH or HTTPS Git URL formats, reject shell syntax and local command-style transports, and display the normalized origin for explicit user confirmation.
-
Add an explicit mandatory validation step to the Skill before Step 7. Setup must stop on any invalid identifier rather than attempting to sanitize ambiguous input.
-
Use an end-of-options marker where supported and ensure user-controlled values are never interpreted as command-line options.
-
Add negative tests covering shell metacharacters, traversal sequences, absolute paths, leading hyphens, whitespace, control characters, and malformed repository URLs.
-