T09 · Insecure Skill Coding Practices
Error
- Location
scripts/schedule-uninstall.sh:43- Finding
Host Command Injection Through Notification Arguments
- Content
View full analysis
/dev/null; then ``` The same unsafe command string is passed to the Linux execution paths: ```bash if systemd-run --user --onetime --unit=openclaw-uninstall \ /bin/bash -c "$CMD" &>/dev/null; then echo "Linux uninstall scheduled (systemd), will run in ~${DELAY}s." else # Fallback: nohup + disown (works when systemd-run unavailable, e.g. WSL2 without systemd) (nohup bash -c "$CMD" >> "$LOG_FILE" 2>&1 &) ``` ### Technical Analysis Values supplied through `--notify-email` and `--notify-ntfy` are appended to a command string between single quotes. The script does not escape embedded single quotes before passing the result to `bash -c`. Shell metacharacters placed after an embedded quote are consequently interpreted as command syntax rather than as part of a notification argument. Array usage while initially collecting the arguments does not protect the values because the array is later converted back into an unsafe shell command string. The Skill documentation explicitly requires this scheduler to run on the gateway host rather than in a sandbox. Exploitation therefore results in command execution directly on that host with the privileges of the user running the Agent. ### Attack Path 1. An attacker persuades the user or Agent to request an ntfy topic or email value containing shell syntax, such as: ```text x'; touch /tmp/openclaw-injected; #' ``` 2. The Agent invokes: ```bash ./scripts/schedule-uninstall.sh --notify-ntfy "x'; to ...[truncated 795 chars]- Remediation
View remediation