T09 · Insecure Skill Coding Practices
Error
- Location
scripts/test-security-scan.sh:79- Finding
Security Test Can Perform an Unintended Real ClawHub Publication
- Content
View full analysis
&1 | grep -q "安全扫描通过"; then echo "✅ 测试 1 通过：安全技能被正确识别" else echo "❌ 测试 1 失败：安全技能未被正确识别" fi ``` The invoked publication script subsequently executes: ```bash # 构建发布命令 PUBLISH_CMD=(clawhub publish "$SKILL_PATH" --version "$VERSION") [ -n "$SLUG" ] && PUBLISH_CMD+=(--slug "$SLUG") [ -n "$NAME" ] && PUBLISH_CMD+=(--name "$NAME") [ -n "$CHANGELOG" ] && PUBLISH_CMD+=(--changelog "$CHANGELOG") # 执行发布 "${PUBLISH_CMD[@]}" ``` ### Technical Analysis The test script attempts to verify the security scanner by invoking the complete `publish.sh` workflow. A successful scan does not terminate after reporting that the scan passed. Instead, `publish.sh` continues to execute the authenticated `clawhub publish` command. Piping the output through `grep -q` only checks the command's output; it does not prevent the publication command from running. Consequently, a script documented as a local scanner test can create remote content under the operator's ClawHub account. The behavior is also environment-dependent because the test uses an absolute path under `/root/.openclaw/workspace` rather than resolving `publish.sh` relative to the repository. ### Attack Path 1. An operator authenticates the `clawhub` CLI. 2. The operator runs the documented `scripts/test-security-scan.sh` test. 3. The script creates a temporary `safe-skill` directory. 4. It invokes the full `publish.sh` workflow for that directory. 5. The generated skill passes the security scan. 6. `publish.sh` executes `clawhub publish` using the operator's authenticated account. 7. Test content may be uploaded to ClawHub even though the operator intended ...[truncated 630 chars]- Remediation
View remediation