T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:21- Finding
Command Injection Through Mandatory Task Interpolation
- Content
View full analysis
'` ``` The same unsafe construction is demonstrated later: ```python exec( command="/opt/homebrew/Caskroom/miniforge/base/bin/python /Users/fanyadan/.openclaw/skills/super-router/scripts/router.py 'Analyze K8s YAML errors and rewrite config'" ) ``` ### Technical Analysis The mandatory invocation workflow instructs the agent to interpolate user-controlled task text between single quotes inside a shell command string. Single quotes do not provide protection when the input itself can contain a single quote. An attacker can close the quoted task argument, append shell syntax, and comment out the remainder. Because the resulting value is supplied to an `exec` interface as a command string, it may be parsed by a shell rather than passed as a structured argument vector. This is especially serious because the unsafe form is described as mandatory. The documentation contains a safer environment-variable invocation elsewhere, but it does not require that form for ordinary tasks. ### Attack Path 1. An attacker submits a router task containing a single quote and shell metacharacters, conceptually: ```text benign task'; ATTACKER_COMMAND; # ``` 2. The agent follows the mandatory instruction and substitutes the task into: ```text router.py '' ``` 3. The injected quote terminates the task argument. 4. The shell interprets the appended text as an additional command. 5. The injected command executes with the operating-system privileges and filesystem acces ...[truncated 378 chars]- Remediation
View remediation