T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:27
- Finding
- Potential PowerShell Command Injection Through Unvalidated File Path and Filename<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 27–31 **Vulnerability Type**: PowerShell command injection through unsafe value interpolation **Risk Level**: Medium ### Vulnerable Code ```powershell 3. **Upload via curl (PowerShell):** ``` curl -si -X POST -H "Content-Type: application/octet-stream" -T "<FILEPATH>" "https://filebin.net/$binId/<FILENAME>" ``` ``` ### Technical Analysis The Skill instructs the Agent to insert a user-selected file path and filename directly into a PowerShell command. It does not require validation, shell-safe argument passing, or filename URL encoding. Double quotes do not make arbitrary untrusted values safe for PowerShell command construction. If the Agent replaces the placeholders textually and invokes the resulting command through PowerShell, a malicious path or filename containing a double quote and PowerShell syntax could terminate the intended argument and introduce an additional command. The filename is also inserted into a URL path without percent-encoding it as an individual URL component. This can cause malformed requests or unintended URL interpretation even when command injection is not achieved. Exploitation depends on the Agent constructing this command through textual substitution rather than passing the values as discrete arguments to a process-execution API. ### Attack Path 1. An attacker creates, supplies, or directs the Agent to a file whose path or filename contains PowerShell-significant characters. 2. The user asks the Skill to upload that file. 3. The Agent locates the file under `~/.openclaw/workspace/`. 4. The Agent replaces `<FILEPATH>` or `<FILENAME>` in the documented command with the attacker-controlled value. 5. If the replacement value terminates the quoted argument, PowerShell interprets the remaining injected syntax as a command. 6. The injected command executes with the operating-system privileges and accessible resources of the Agent process. ### Impa ...[truncated 483 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct a shell command by interpolating the path, filename, bin identifier, or URL into command text. 2. Use a structured process-execution API that invokes `curl` directly with a discrete argument array and does not enable shell evaluation. 3. Resolve the requested file to a canonical path and verify that it: - Is inside the authorized workspace directory. - Is a regular file rather than a directory or unexpected special file. - Is the exact file explicitly selected by the user. 4. Generate the destination URL programmatically and percent-encode the filename as one URL path segment. 5. Validate the generated bin identifier against the documented length and character requirements. 6. If PowerShell invocation is unavoidable, pass values through parameters as literal data rather than inserting them into a command string. Reject control characters and filenames that cannot be represented safely. 7. Preserve the existing warning that filebin.net uploads are public, and require explicit user confirmation before uploading potentially sensitive files. ]]>