T09 · Insecure Skill Coding Practices
Error
- Location
scripts/minimax_mcp.js:32- Finding
Command Injection Through the MINIMAX_PYTHON Environment Variable
- Content
View full analysis
JSON.stringify(m)).join('\n') + '\n'; const result = execSync(`"${pythonExe}" -m minimax_mcp.server`, { env: { ...process.env, MINIMAX_API_KEY: apiKey, MINIMAX_API_HOST: apiHost, FASTMCP_LOG_LEVEL: 'ERROR', REQUESTS_CA_BUNDLE: VENV_CERTIFI_CA }, input, maxBuffer: 10 * 1024 * 1024, timeout: 60000, shell: true, windowsHide: true }); ``` ### Technical Analysis The value of `MINIMAX_PYTHON` is read from the process environment and interpolated directly into a command string passed to `execSync`. The command is explicitly executed with `shell: true`. Wrapping the value in double quotes is not sufficient shell escaping. A malicious value containing a closing quote followed by shell metacharacters can terminate the intended executable token and append another command. The exact metacharacters required depend on the operating system shell. This issue is reachable whenever the wrapper runs an MCP operation, including the `search`, `image`, and `tools` commands. Exploitation requires the attacker to influence the environment inherited by the Node.js process, such as through an editable OpenClaw configuration, deployment configuration, wrapper script, or compromised parent process. ### Attack Path 1. The attacker obtains the ability to modify `MINIMAX_PYTHON` in the environment or OpenClaw configuration. 2. The attacker supplies a value that closes the quoted executable path and appends a shell command. 3. A user or agent invokes the skill using `search`, `image`, or `tools`. 4. `runMCP()` constructs a com ...[truncated 829 chars]- Remediation
View remediation