T09 · Insecure Skill Coding Practices
Error
- Location
scripts/setup-agent.sh:13- Finding
Path Traversal Through an Unvalidated Agent Name Allows File Overwrite Outside the Workspace Root
- Content
View full analysis
[credentials...]}" CHANNEL="${2:?Please specify channel: telegram|discord|slack|feishu|whatsapp|signal|googlechat}" AGENT_ID="${AGENT_NAME,,}-agent" AGENT_DIR="${AGENT_NAME,,}" STATE_DIR="${OPENCLAW_STATE_DIR:-$HOME/.openclaw}" WORKSPACE_DIR="${STATE_DIR}/workspace-groups/${AGENT_DIR}" CONFIG_PATH="${STATE_DIR}/openclaw.json" ``` ```bash # 2. Create workspace mkdir -p "${WORKSPACE_DIR}" # 3. Register agent openclaw agents add "${AGENT_ID}" 2>/dev/null || true # 4. Generate workspace files cat > "${WORKSPACE_DIR}/IDENTITY.md" << EOF # IDENTITY.md - **Name:** ${AGENT_NAME} - **Role:** [Define role here] - **Emoji:** 🤖 EOF cat > "${WORKSPACE_DIR}/SOUL.md" << EOF # SOUL.md You are ${AGENT_NAME}, an independent AI assistant. Be genuinely helpful. Have opinions. Try before asking. Keep private things private. Never send half-baked replies. EOF cat > "${WORKSPACE_DIR}/AGENTS.md" << EOF # AGENTS.md ## On startup 1. Read SOUL.md 2. Read IDENTITY.md 3. Read USER.md if present ## Memory Write important notes to memory/YYYY-MM-DD.md EOF cat > "${WORKSPACE_DIR}/USER.md" << EOF # USER.md - **Name:** [User Name] - **Timezone:** UTC EOF touch "${WORKSPACE_DIR}/HEARTBEAT.md" touch "${WORKSPACE_DIR}/TOOLS.md" ``` ### Technical Analysis The script directly incorporates the caller-controlled `AGENT_NAME` into `WORKSPACE_DIR`. It does not enforce an identifier format, reject path separators, or verify the canonical destination against the intended `workspace-groups` directory. An agent name containing `../` components can make the effective workspace resolve outside `${STATE_DIR}/workspace-groups`. The script then creates the resulting directory and unconditionally redirects content into fixed filenames s ...[truncated 1934 chars]- Remediation
View remediation
&2 exit 1 fi ``` 2. Maintain separate values for a validated directory identifier and a human-readable display name. 3. Canonicalize the workspace root and destination, then verify that the destination remains a direct child of the workspace root. 4. Reject names containing `/`, `\`, `..`, newlines, control characters, or leading hyphens. 5. Refuse to overwrite an existing workspace unless the user explicitly requests a safe update operation. 6. Use protections against symbolic-link traversal. Verify directories and files with `lstat`-equivalent checks and create new files using no-follow and exclusive-creation semantics where possible. 7. Write generated content to safely created temporary files in the destination and atomically rename them only after validation. 8. Add tests covering traversal strings, absolute-looking paths, repeated separators, control characters, and pre-existing symbolic links. ]]>