T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/minimax_mcp.js:32
- Finding
- Command Injection Through the MINIMAX_PYTHON Environment Variable<![CDATA[ ## Vulnerability Details **File Location**: `scripts/minimax_mcp.js`, lines 32–45 **Vulnerability Type**: OS command injection through an environment-controlled executable path **Risk Level**: High ### Vulnerable Code ```javascript const pythonExe = process.env.MINIMAX_PYTHON || defaultPy; const apiHost = process.env.MINIMAX_API_HOST || 'https://api.minimaxi.com'; function runMCP(messages) { const input = messages.map(m => JSON.stringify(m)).join('\n') + '\n'; const result = execSync(`"${pythonExe}" -m minimax_mcp.server`, { env: { ...process.env, MINIMAX_API_KEY: apiKey, MINIMAX_API_HOST: apiHost, FASTMCP_LOG_LEVEL: 'ERROR', REQUESTS_CA_BUNDLE: VENV_CERTIFI_CA }, input, maxBuffer: 10 * 1024 * 1024, timeout: 60000, shell: true, windowsHide: true }); ``` ### Technical Analysis The value of `MINIMAX_PYTHON` is read from the process environment and interpolated directly into a command string passed to `execSync`. The command is explicitly executed with `shell: true`. Wrapping the value in double quotes is not sufficient shell escaping. A malicious value containing a closing quote followed by shell metacharacters can terminate the intended executable token and append another command. The exact metacharacters required depend on the operating system shell. This issue is reachable whenever the wrapper runs an MCP operation, including the `search`, `image`, and `tools` commands. Exploitation requires the attacker to influence the environment inherited by the Node.js process, such as through an editable OpenClaw configuration, deployment configuration, wrapper script, or compromised parent process. ### Attack Path 1. The attacker obtains the ability to modify `MINIMAX_PYTHON` in the environment or OpenClaw configuration. 2. The attacker supplies a value that closes the quoted executable path and appends a shell command. 3. A user or agent invokes the skill using `search`, `image`, or `tools`. 4. `runMCP()` constructs a com ...[truncated 829 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Avoid constructing a shell command. Invoke the executable directly with a fixed argument array and disable shell processing: ```javascript const { execFileSync } = require('child_process'); const result = execFileSync(pythonExe, ['-m', 'minimax_mcp.server'], { env: { ...process.env, MINIMAX_API_KEY: apiKey, MINIMAX_API_HOST: apiHost, FASTMCP_LOG_LEVEL: 'ERROR', REQUESTS_CA_BUNDLE: VENV_CERTIFI_CA }, input, maxBuffer: 10 * 1024 * 1024, timeout: 60000, windowsHide: true, shell: false }); ``` Additionally: 1. Resolve the configured path to an absolute path. 2. Verify that it points to an existing regular executable file. 3. Where practical, restrict it to an administrator-approved virtual environment. 4. Reject control characters and unexpected path formats. 5. Protect configuration and environment-setting mechanisms from modification by untrusted users. ]]>