T09 · Insecure Skill Coding Practices
- Location
lib/search.js:137- Finding
Shell Command Injection Through Unquoted Indexed Documentation Paths
- Content
View full analysis
Vulnerability Details
File Location:
lib/search.js, lines 137-138
Vulnerability Type: Shell command injection through unsafe command generation
Risk Level: MediumVulnerable Code:
javascript lines.push(`💡 Read with:`); lines.push(` cat ${best.path}`);Technical Analysis
The application interpolates
best.pathdirectly into a suggested shell command without quoting, escaping, or using the--option delimiter. This path originates from Markdown filenames discovered recursively during indexing and stored in the SQLite database.Although the application does not execute the generated command itself, its documented workflow directs an AI agent or user to execute the returned
catcommand. A filename containing shell metacharacters such as command substitution, semicolons, redirection operators, or spaces can alter the command's meaning when the suggestion is copied into a shell.Exploitation requires an attacker to control a Markdown filename in the indexed documentation tree or tamper with the local index. For example, a path containing shell command-substitution syntax could cause the shell to execute the embedded command when the generated output is followed.
Attack Path
- An attacker gains the ability to add or rename a Markdown file under the configured documentation directory, which defaults to
/usr/lib/node_modules/openclaw/docs. - The attacker gives the file a name containing shell metacharacters or command-substitution syntax.
- The victim runs
node scripts/docs-index.js rebuild, causing the path to be stored in the documentation index. - A search returns the attacker-controlled file as the best result.
- The application prints the path as an unquoted
catcommand. - A user or AI agent follows the documented workflow and executes the generated command in a shell.
- The injected shell syntax runs with the privileges of that user or agent process.
Impac
...[truncated 612 chars]
- An attacker gains the ability to add or rename a Markdown file under the configured documentation directory, which defaults to
- Remediation
View remediation
Remediation Suggestions
- Do not format search results as executable shell commands. Return the path as plain data and instruct callers to use a trusted filesystem-reading API or tool.
- If a shell command must be displayed, apply robust POSIX shell quoting to the complete path and use an option delimiter:
text cat -- 'properly escaped path' - Never implement escaping by only replacing spaces; correctly escape embedded single quotes and all other shell-significant characters.
- Consider validating indexed paths with
fs.realpathSync()and confirming that they remain inside the configured documentation root. - Treat index contents as untrusted when loading paths from SQLite, since a local attacker could tamper with the index independently of the source documents.