T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:86- Finding
Shell Command Injection Through Unquoted User-Controlled Arguments
- Content
View full analysis
``` Example: user says "check arb for wcBTC and USDC" → run: ```bash cd ~/.openclaw/skills/citrea-claw-skill && node index.js arb:check wcBTC USDC.e ``` ``` The same unsafe construction pattern appears in other command templates, including `price`, `pool:price`, `pool:liquidity`, `balance`, and `txns`. ### Technical Analysis The Skill instructs the agent to build shell command strings by inserting token symbols, addresses, or other values derived from user messages. These arguments are not quoted or validated before being placed into commands executed through the `exec` tool. Although the JavaScript command handlers perform some validation, that validation occurs only after the shell has parsed the command line. Shell metacharacters such as command separators, substitutions, pipes, or redirections can therefore be interpreted before `index.js` receives its arguments. The issue exceeds the minimum privileges required by the declared functionality. Reading public Citrea data requires only launching Node.js with fixed command names and validated data arguments; it does not require passing user-controlled text through a command shell. ### Attack Path 1. A user invokes a supported Skill trigger and supplies a malicious token or address argument containing shell syntax. 2. The agent follows `SKILL.md` and interpolates that value into the documented command string. 3. The `exec` tool invokes the command through a shell. 4. The shell interprets the injected syntax independently of the intended `node index.js` command. 5. The injected command runs with the ...[truncated 752 chars]- Remediation
View remediation