T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup.sh:17- Finding
Persistent Shell Command Injection Through Generated Configuration
- Content
View full analysis
"$config_file" << EOF BACKUP_ROOT="$backup_root" OLD_BACKUP_ROOT="$old_backup_root" OPENCLAW_HOME="$HOME/.openclaw" KEEP_COUNT=$keep_count MAX_OLD_SIZE_GB=$max_old_size_gb TARGET_OLD_SIZE_GB=5 EOF ``` The generated file is subsequently executed as shell code: ```bash if [ -f "$CONFIG_FILE" ]; then source "$CONFIG_FILE" fi ``` ### Technical Analysis Interactive values are inserted directly into an executable shell configuration without validation or shell-safe serialization. Characters such as quotes, command substitutions, backticks, semicolons, and newlines can alter the syntax of `config.sh`. Because `backup.sh` uses `source`, the configuration is not treated as passive data. Every command injected into or independently added to `config.sh` runs in the context of the backup process. The flaw is persistent because the malicious content remains in the generated file and executes on subsequent backup runs. ### Attack Path 1. An attacker persuades a user to enter a crafted setup value or gains the ability to influence setup input. 2. For example, a path containing command substitution or a newline followed by a shell command is entered. 3. `setup.sh` writes the value directly into `scripts/config.sh`. 4. The user or an automa ...[truncated 887 chars]- Remediation
View remediation