T09 · Insecure Skill Coding Practices
Warning
- Location
find_skills.py:871- Finding
Arbitrary Local File Contents Can Be Transmitted as a ClawHub Search Query
- Content
View full analysis
Tuple[int, str, str, List[str], List[str]]: tried: List[str] = [] merged_out: List[str] = [] merged_err: List[str] = [] urls: List[str] = [] seen_urls: set[str] = set() final_code = -1 for q in _clawhub_query_variants(query, kws or []): tried.append(q) code, out, err = _run_clawhub(["search", q]) ``` ```python def _read_arg_query(argv: List[str]) -> str: if len(argv) < 3: return "" raw = argv[2].strip() if raw == "-": return sys.stdin.read().strip() if raw.startswith("@") and len(raw) > 1: return Path(raw[1:]).read_text(encoding="utf-8").strip() ``` ### Technical Analysis The `@file` query syntax accepts an arbitrary filesystem path and reads its complete contents without applying a directory allowlist, file-size limit, file-type validation, sensitivity check, redaction, or user confirmation. The resulting text becomes the search query. `_clawhub_search_cli()` passes that query directly to `clawhub search`. ClawHub search is the network-backed mechanism required by the declared search functionality, so the local file contents may be submitted to the ClawHub service by the external CLI. Supporting file-based queries is documented in `SKILL.md`, but unrestricted access to any file readable by the current process exceeds the minimum privileges needed for skill discovery. A normal short search string is sufficient for that purpose. The behavior is especially risky when an AI agent can be induced to use a path without understanding that the file's contents will become a remote query. This is not shell command injection: the subprocess uses an argument ...[truncated 2048 chars]- Remediation
View remediation