T09 · Insecure Skill Coding Practices
Error
- Location
scripts/deploy.sh:17- Finding
Environment-Controlled File Used as Emergency Rollback Source
- Content
View full analysis
/dev/null || true fi fi ``` ### Technical Analysis The script never defines or validates `BLUE_LONG_NAME`. Bash therefore obtains its value from the inherited process environment when it is present. Although the existence check is performed against `${BLUE_CONFIG}.tmp`, the source passed to `mv` can be an entirely different path selected through `BLUE_LONG_NAME`. This creates a mismatch between the validated file and the file actually used for restoration. Because `cleanup` is registered as an `EXIT` trap, any nonzero termination can reach this operation. In the normal validation-failure path, the script first restores the backup and exits with status 1; the cleanup handler can then overwrite that restored configuration with the environment-selected source. ### Attack Path 1. An attacker who can influence the deployment process environment creates a malicious OpenClaw configuration at a path accessible to the invoking user. 2. The attacker exports `BLUE_LONG_NAME` with that path: ```bash export BLUE_LONG_NAME=/path/to/malicious-openclaw.json ``` 3. The attacker ensures `$HOME/.openclaw/openclaw.json.tmp` exists, or invokes the script far enough for line 57 to create it. 4. The deployment is made to terminate with a nonzero status, such as by causing validation to fail. 5. The `EXIT` trap confirms that the `.tmp` file exists but executes: ```bash mv "$BLUE_LONG_NAME" "$BLUE_CONFIG" ``` 6. The ...[truncated 531 chars]- Remediation
View remediation