T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/generate-lobster.py:47
- Finding
- Shell Command Injection Through Untrusted Workflow Analysis Fields<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate-lobster.py:47-52, 81-90` **Vulnerability Type**: Command injection through unsafe shell-command construction **Risk Level**: High ### Vulnerable Code ```python else: # Generic placeholder lobster_step["command"] = f"echo 'TODO: Implement {step.get('action', 'action')}'" lobster_step["_todo"] = f"Tool: {step.get('tool')} | Action: {step.get('action')}" ``` ```python def generate_browser_command(step: dict) -> str: """Generate browser automation command.""" action = step.get("action", "").lower() ui_element = step.get("ui_element", "") if "click" in action: return f"openclaw.invoke --tool browser --action act --args-json '{{\"kind\": \"click\", \"ref\": \"{ui_element}\"}}'" elif "type" in action or "enter" in action: return f"openclaw.invoke --tool browser --action act --args-json '{{\"kind\": \"type\", \"ref\": \"{ui_element}\", \"text\": \"${{input}}\"}}'" ``` ### Technical Analysis The generator treats fields from `analysis.json` as trusted and interpolates them directly into strings intended to be executed as shell commands. These fields can originate from a vision model analyzing attacker-controlled frames and transcripts, or from a directly supplied analysis file. In the generic command, a single quote in `action` can terminate the quoted `echo` argument and append shell syntax. In browser commands, `ui_element` is embedded inside nested JSON and shell quoting without JSON-safe serialization or shell-safe argument handling. YAML serialization does not remove this vulnerability. It only serializes the resulting string; when Lobster executes the `command` value through a shell, shell metacharacters remain effective. ### Attack Path 1. An attacker controls or influences a Loom recording, transcript, frame content, or supplied analysis JSON. 2. The resulting model output places shell syntax in `action` or `ui_element`. 3. `gener ...[truncated 991 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Treat every model-generated field as untrusted input. - Do not represent tool operations as interpolated shell strings. Emit structured commands with separately encoded arguments. - Define a strict schema for supported operation types and reject unknown actions. - Validate UI references as opaque identifiers using a restrictive allowlist. - Serialize JSON arguments with `json.dumps()` rather than manually constructing JSON. - If a subprocess is required, invoke it with an argument array and `shell=False`. - If shell execution cannot be eliminated, apply context-appropriate shell escaping and reject control characters and shell metacharacters. Escaping alone should not be the primary defense. - Require review and approval before executing any model-generated workflow, not only steps labeled ambiguous. - Add tests using quotes, newlines, command substitutions, redirections, and shell separators in every model-controlled field. ]]>