T09 · Insecure Skill Coding Practices
Error
- Location
scripts/auth_checker.sh:50- Finding
Predictable Temporary File Allows Symlink-Based File Clobbering
- Content
View full analysis
/tmp/openclaw_status.txt 2>&1; then echo "✅ OpenClaw status command succeeded" # Check for auth-related errors in output (without showing sensitive info) if grep -iq "auth" /tmp/openclaw_status.txt; then echo "ℹ️ Auth information found in status" fi if grep -iq "error\|fail\|unavailable" /tmp/openclaw_status.txt; then echo "⚠️ Potential issues detected in status" echo " Run 'openclaw status' manually to see details" fi else echo "❌ OpenClaw status command failed" echo " This suggests auth or gateway issues" echo " Check gateway is running: openclaw gateway status" fi # Clean up temp file rm -f /tmp/openclaw_status.txt ``` ### Technical Analysis The script writes OpenClaw status output to the fixed, globally predictable path `/tmp/openclaw_status.txt`. Shell redirection opens this path with truncation and follows symbolic links. The script neither creates the file securely nor verifies its ownership, type, or permissions before writing. On a multi-user system, another local user can create that path in advance as a symbolic link to a file writable by the victim. When the victim runs the checker, the shell follows the link and truncates or overwrites the target using the victim's privileges. The fixed filename also permits concurrent executions to read, overwrite, or delete each other's output. Depending on the process umask, status output containing authentication-related or operational information may be readable by other local users before cleanup. ### Attack Path 1. A local attacker identifies a file that the victim can write and whose corruption would affect the victim. 2. The attacker creates ...[truncated 1233 chars]- Remediation
View remediation
&2 exit 1 } trap 'rm -f -- "$STATUS_FILE"' EXIT if source "$HOME/.openclaw/.env" && openclaw status > "$STATUS_FILE" 2>&1; then if grep -iq "auth" "$STATUS_FILE"; then echo "Auth information found in status" fi if grep -Eiq "error|fail|unavailable" "$STATUS_FILE"; then echo "Potential issues detected in status" fi fi ``` Additional hardening measures: 1. Do not use a constant filename in a shared temporary directory. 2. Set `umask 077` before creating files that can contain operational or authentication-related information. 3. Use an `EXIT` trap so cleanup occurs after errors and signals. 4. Quote the generated filename and use `rm -f --` to prevent argument interpretation. 5. Avoid elevated execution; explicitly document that this diagnostic script should run as the OpenClaw account. 6. If persistent output is unnecessary, consider capturing output in a shell variable rather than writing it to disk. ]]>