T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-lobster.py:47- Finding
Shell Command Injection Through Untrusted Workflow Analysis Fields
- Content
View full analysis
str: """Generate browser automation command.""" action = step.get("action", "").lower() ui_element = step.get("ui_element", "") if "click" in action: return f"openclaw.invoke --tool browser --action act --args-json '{{\"kind\": \"click\", \"ref\": \"{ui_element}\"}}'" elif "type" in action or "enter" in action: return f"openclaw.invoke --tool browser --action act --args-json '{{\"kind\": \"type\", \"ref\": \"{ui_element}\", \"text\": \"${{input}}\"}}'" ``` ### Technical Analysis The generator treats fields from `analysis.json` as trusted and interpolates them directly into strings intended to be executed as shell commands. These fields can originate from a vision model analyzing attacker-controlled frames and transcripts, or from a directly supplied analysis file. In the generic command, a single quote in `action` can terminate the quoted `echo` argument and append shell syntax. In browser commands, `ui_element` is embedded inside nested JSON and shell quoting without JSON-safe serialization or shell-safe argument handling. YAML serialization does not remove this vulnerability. It only serializes the resulting string; when Lobster executes the `command` value through a shell, shell metacharacters remain effective. ### Attack Path 1. An attacker controls or influences a Loom recording, transcript, frame content, or supplied analysis JSON. 2. The resulting model output places shell syntax in `action` or `ui_element`. 3. `gener ...[truncated 991 chars]- Remediation
View remediation