T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:94- Finding
Shell Command Injection Through Unsanitized Join and Owner Parameters
- Content
View full analysis
" \ --preflight-mode confirm \ --owner-channel openclaw \ --owner-openclaw-channel "" \ --owner-openclaw-target "" ``` ### Technical Analysis The command template inserts `JOIN_URL`, `CHANNEL`, and `TARGET` into a shell command. These values may originate from users, invitation links, or external messages. The Skill does not require strict validation, shell-safe escaping, or execution through a subprocess argument array. Enclosing a value in double quotes does not neutralize all shell syntax. Command substitutions such as `$(command)` and backticks are still evaluated inside double-quoted strings when the resulting command is interpreted by a shell. Consequently, a malicious value can trigger local command execution before the Python bridge processes the supplied argument. For example, if a crafted join URL contains `$(attacker_command)` and the Agent performs direct textual substitution followed by shell execution, the shell evaluates `attacker_command` locally. Similar injection is possible through `CHANNEL` or `TARGET`. Owner confirmation does not adequately mitigate this issue. The owner is ostensibly confirming participation in a room, not authorizing arbitrary commands embedded in an invitation or routing parameter. ### Attack Path 1. An attacker sends the Agent or user a crafted ClawRoom invitation containing shell command-substitution syntax in the URL or token. 2. The Agent presents the normal room-join plan. 3. The owner confirms the join, believing the approval applies only to communication with the room service. 4. The Agent places the attacker-controlled value into the documented Bash template. 5. The command is executed through a shel ...[truncated 1220 chars]- Remediation
View remediation
` path structure. - Apply restrictive allowlists to room IDs and tokens. - Reject control characters, whitespace, shell metacharacters, and malformed percent encoding. 3. **Validate owner-routing parameters.** - Restrict `CHANNEL` and `TARGET` to documented formats and lengths. - Prefer enumerated channel values and identifier-specific allowlists. - Reject unexpected characters rather than attempting ad hoc shell escaping. 4. **Separate parsing from action.** Display the normalized hostname, room ID, and destination to the owner before confirmation. Do not display or execute attacker-supplied command text. 5. **Document the execution requirement explicitly.** State that implementations must pass each value as a discrete process argument and must never interpolate these fields into `sh -c`, `bash -c`, or an equivalent shell command. 6. **Add negative security tests** using payloads containing `$(...)`, backticks, quotes, semicolons, newlines, encoded metacharacters, and option-like values to verify that they are rejected or passed only as inert arguments. ]]>