T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:11
- Finding
- Shell Command Injection Through Unquoted User-Controlled Token## Vulnerability Details **File Location**: `SKILL.md`, lines 11-15 **Vulnerability Type**: Shell command injection **Risk Level**: High **Vulnerable Code**: ```markdown 2. Run the rotation script: ```bash bash /opt/homebrew/lib/node_modules/openclaw/skills/keyswap/scripts/keyswap.sh <token> ``` ``` ### Technical Analysis The instructions direct the agent to place a user-provided token directly into a shell command, but they do not require shell-safe argument passing or quoting. The only stated validation rule is that the value must begin with `sk-ant-`. A value can satisfy that prefix requirement while containing shell metacharacters such as semicolons, command substitutions, redirections, or pipelines. If the agent constructs and executes the documented command as a shell string, the shell interprets those metacharacters before `keyswap.sh` receives and validates its arguments. Consequently, the prefix check inside the script cannot prevent command injection that occurs during shell parsing. ### Attack Path 1. An attacker provides a purported token beginning with the required `sk-ant-` prefix but followed by shell syntax. 2. The agent substitutes the value into the documented command without shell-safe quoting. 3. The command runner invokes a shell to interpret the constructed command. 4. The shell processes the injected metacharacters before starting `keyswap.sh`. 5. The injected command executes with the same operating-system privileges as the agent or OpenClaw process. 6. Any subsequent validation performed by `keyswap.sh` is ineffective against the command that has already executed. ### Impact Assessment Successful exploitation could provide arbitrary command execution under the account running the agent. The attacker could read or modify files accessible to that account, steal credentials such as OpenClaw authentication profiles, alter agent configuration, execute additional local programs, or di ...[truncated 152 chars]
- Remediation
- ## Remediation Suggestions - Do not interpolate the token into a shell command string. - Invoke the script through a structured process-execution API that passes each argument as a separate argument vector element without shell interpretation. - Prefer reading the token from protected standard input or a dedicated file descriptor rather than placing it on the command line. - If shell execution is unavoidable, apply robust shell escaping generated by a trusted mechanism rather than manually adding quotation marks. - Validate the complete token format and length, not only its prefix. Reject control characters, whitespace, shell metacharacters, and unexpected character classes. - Update the Skill instructions to explicitly prohibit constructing a shell command through raw string substitution.