T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:112- Finding
Shell Command Injection Through Unquoted Callback Concatenation
- Content
View full analysis
` immediately ``` ### Technical Analysis The Skill instructs an agent to concatenate attacker-influenced `callback_data` directly into a command string passed to the `exec` tool. No shell quoting or complete callback validation is applied before constructing the command. The documented detection expression only verifies that inbound text starts with an accepted prefix. It is not anchored at the end and does not prevent shell metacharacters, substitutions, redirections, or additional commands from appearing after the valid-looking prefix. If the OpenClaw `exec` tool evaluates the supplied command through a shell, characters such as command separators or command substitutions in the inbound callback can be interpreted by that shell rather than being passed only as an argument to `browser_dispatcher.py`. The Python implementation itself uses argument arrays when launching its child processes, but that protection does not cover the vulnerable command construction prescribed by `SKILL.md`. ### Attack Path 1. An attacker sends a Telegram text message beginning with a recognized callback prefix, such as `tfb_preview_`. 2. The message appends shell syntax after the accepted prefix. 3. Following the Skill instructions, the agent treats the entire inbound message as callback data. 4. The agent concatenates that data into the `exec(command="...") ...[truncated 838 chars]- Remediation
View remediation