T09 · Insecure Skill Coding Practices
- Location
SKILL.md:38- Finding
Arbitrary Shell Command Injection Through User-Controlled outputDir
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 38
Vulnerability Type: Shell command injection through unsafeeval
Risk Level: HighVulnerable Code
sh outputDir=$(eval echo "$outputDir")Technical Analysis
The
outputDirvalue originates from the Skill's input schema and is therefore user-controlled. Although it is enclosed in double quotes when passed toeval,evalreparses the resulting text as shell syntax. Command substitutions, shell operators, and other metacharacters contained in the input can consequently be executed rather than treated as path characters.Using
evalis unnecessary for resolving a leading~in a path. This creates an arbitrary command-execution primitive within a workflow that should only read a Markdown draft and write generated articles.For example, a malicious value containing command substitution can trigger execution during initialization:
text $(touch /tmp/skill-pwned)Attack Path
- An attacker supplies a crafted
outputDirthrough the Skill's input interface. - The
initworkflow assigns that untrusted value to the shell variable. - Line 38 passes the value through
eval. - The shell reparses command substitutions or metacharacters in the value.
- The injected command executes with the privileges and environment of the Agent or Skill runner.
- The attacker can invoke locally available commands and access resources available to that process.
This path does not require a network request or a malicious packaged script; exploitation occurs through the normal
outputDirparameter.Impact Assessment
Successful exploitation permits arbitrary local command execution under the Skill process account. Depending on that account's permissions, an attacker may be able to:
- Read files accessible to the Agent runner.
- Create, modify, overwrite, or delete accessible files.
- Execute installed programs and scripts.
- Access environment variables and other proce ...[truncated 340 chars]
- An attacker supplies a crafted
- Remediation
View remediation
Remediation Suggestions
Remove
evalentirely. If expansion of a literal home-directory prefix is required, handle only explicitly supported forms with shell parameter operations:sh case "$outputDir" in "~") outputDir="$HOME" ;; "~/"*) outputDir="$HOME/${outputDir#~/}" ;; esacApply the following additional hardening measures:
- Validate that
outputDiris a non-empty path without control characters. - Resolve it to a canonical path using a safe platform-appropriate mechanism.
- Enforce an allowlisted parent directory, such as the designated OpenClaw workspace.
- Reject paths that escape the allowed root through
..components or symbolic links. - Keep variables quoted in all filesystem operations.
- Create the destination with restrictive permissions before writing.
- Add regression tests using values containing
$(...), backticks, semicolons, newlines, spaces, glob characters, and traversal sequences to verify that no shell evaluation occurs.
- Validate that