T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:711- Finding
Shell Command Injection Through Unsanitized Cost Tracker Task Descriptions
- Content
View full analysis
> ~/.openclaw/cost-tracker.md ``` ### Technical Analysis The skill instructs the agent to interpolate a short task description into a shell command executed through the `exec` tool. The task description is derived from user-provided content, but the instructions do not require shell escaping, validation, or removal of shell metacharacters. Because the value is inserted inside a double-quoted shell argument, shell constructs such as command substitution using `$(...)` or backticks remain active. Embedded quotation marks, newlines, redirection operators, and other metacharacters could also terminate or alter the intended command. The same input could corrupt the Markdown table even when it does not achieve command execution. The vulnerability is conditional on the agent constructing the command by replacing `[SHORT TASK DESC]` with task-derived text, as explicitly directed by the skill. ### Attack Path 1. An attacker submits a task containing shell syntax in text likely to be retained in the generated short description, such as a command substitution expression. 2. The Cost Advisor recommends a model change for that task. 3. The user follows the recommendation and switches models. 4. The skill directs the agent to append a tracker row through `exec`. 5. The agent places the attacker-controlled description into the documented double-quoted `echo` command. 6. The local shell evaluates the injected syntax while appending the tracker entry. 7. The injected command executes with the same operating-system privileges and environment access as the OpenClaw agent process. ### Impact Assess ...[truncated 549 chars]- Remediation
View remediation