T09 · Insecure Skill Coding Practices
- Location
package.json:33- Finding
Shell Command Injection Through Unquoted User-Controlled Parameters
- Content
View full analysis
Vulnerability Details
File Location:
package.json, lines 33–65
Vulnerability Type: OS command injection through unsafe template interpolation
Risk Level: High
Category: T09: Insecure Skill Coding PracticesVulnerable Code
json { "trigger": "/dogecoin-node balance", "description": "Fetch the balance of a specific Dogecoin address", "parameters": [ { "name": "address", "type": "string", "required": true } ], "handler": "bash", "script": "$HOME/dogecoin-cli -datadir=$HOME/.dogecoin getreceivedbyaddress {{address}}" }, { "trigger": "/dogecoin-node send", "description": "Send DOGE to a recipient", "parameters": [ { "name": "recipient", "type": "string", "required": true }, { "name": "amount", "type": "number", "required": true } ], "handler": "bash", "script": "$HOME/dogecoin-cli -datadir=$HOME/.dogecoin sendtoaddress {{recipient}} {{amount}}" }, { "trigger": "/dogecoin-node txs", "description": "List recent transactions for an address", "parameters": [ { "name": "address", "type": "string", "required": true } ], "handler": "bash", "script": "$HOME/dogecoin-cli -datadir=$HOME/.dogecoin listreceivedbyaddress 1 true true {{address}}" }Technical Analysis
The
address,recipient, andamountparameters are inserted directly into command strings handled by Bash. They are not safely passed as discrete process arguments, shell-escaped, quoted, or validated against strict Dogecoin address and amount formats.If the OpenClaw template engine performs direct substitution before invoking Bash, shell metacharacters embedded in an argument can alter the command structure. Declaring a parameter as a JSON
stringornumberdoes not by itself establish that runtime input is syntactically safe for a shell.This is particularly severe for the
sendhandler because it operates against a wallet-enabled Dogec ...[truncated 1817 chars]- Remediation
View remediation
Remediation Suggestions
- Do not construct wallet commands through Bash string interpolation. Invoke
dogecoin-cliusing an API that accepts an executable and an argument array. - Validate recipient and address inputs before execution:
- Require the expected Dogecoin address encoding and length.
- Reject whitespace, shell metacharacters, control characters, and trailing data.
- Prefer an authoritative Dogecoin address-validation routine over a permissive regular expression.
- Parse amounts into a decimal or fixed-point representation and enforce explicit minimum, maximum, precision, and balance limits.
- Add transaction confirmation or approval for all fund-transfer operations.
- Run wallet commands under a dedicated, minimally privileged account.
- Restrict the RPC interface to the exact commands needed by the Skill and protect the wallet with appropriate operational controls.
- Add security tests containing spaces, quotes, command separators, substitutions, redirections, and newline characters to confirm that inputs can never affect command structure.
- Do not construct wallet commands through Bash string interpolation. Invoke