T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/logger.sh:29- Finding
Unrestricted Log Destination Allows Path Traversal and Symlink-Based File Writes
- Content
View full analysis
> "$LOG_PATH" } ``` ### Technical Analysis The logger constructs its output path by directly concatenating an unvalidated workspace path, the fixed `logs` directory, and the caller-controlled `LOG_FILE` environment variable. Workspace values can also originate from `WORKSPACE`, `OPENCLAW_WORKSPACE`, or the positional argument to `init`. No validation, canonicalization, filename restriction, or containment check is performed. Consequently, a `LOG_FILE` value containing traversal sequences such as `../../../tmp/target` can resolve outside the intended workspace log directory. The append redirection also follows symbolic links. If an attacker can create or replace the selected log file or log directory with a symbolic link, subsequent logger invocations can append data to the link target. This is an arbitrary append rather than a fully arbitrary overwrite because the shell uses `>>`. Exploitation remains limited to files writable by the operating-system account running the skill. ### Attack Path 1. An attacker gains ...[truncated 1401 chars]- Remediation
View remediation