T09 · Insecure Skill Coding Practices
- Location
scripts/notify.sh:5- Finding
Arbitrary Shell Execution Through Sourced Configuration
- Content
View full analysis
Vulnerability Details
File Location:
scripts/notify.sh, lines 5–11
Vulnerability Type: Unsafe execution of a configuration file
Risk Level: MediumVulnerable Code
bash CONFIG_FILE="${HOME}/.claude/mac-notify.env" LOG_FILE="${HOME}/.claude/mac-task-notify.log" if [[ -f "$CONFIG_FILE" ]]; then # shellcheck disable=SC1090 source "$CONFIG_FILE" fiTechnical Analysis
The notification hook loads
~/.claude/mac-notify.envwith Bash'ssourcecommand. Although this file is described as configuration,sourceinterprets its entire contents as shell code rather than parsing it as inert key-value data.Consequently, command substitutions, function calls, redirections, and arbitrary shell commands embedded in the configuration file execute with the privileges and environment of the user running the hook. The hook installer registers this script for both
StopandTaskCompletedevents, so malicious content can execute repeatedly whenever either event occurs.Exploitation requires an attacker or compromised process to modify the user's configuration file. The code shown does not itself provide remote access to that file, so exploitability depends on its ownership, permissions, and surrounding workflows.
Attack Path
-
An attacker, compromised local process, or unsafe configuration synchronization mechanism gains the ability to alter
~/.claude/mac-notify.env. -
The attacker inserts shell code into the file, for example:
bash OPENCLAW_NOTIFY_TARGET= malicious_command -
Claude Code emits a
StoporTaskCompletedevent. -
The installed hook invokes
scripts/notify.sh. -
The script executes
source "$CONFIG_FILE". -
Bash evaluates the attacker's command with the current user's privileges.
Impact Assessment
Successful exploitation provides arbitrary command execution as the user who runs Claude Code. The attacker could access or modify files available to that user, invoke installed applic ...[truncated 275 chars]
-
- Remediation
View remediation
Remediation Suggestions
- Do not use
sourceorevalto load configuration data. - Parse only an explicit allowlist of supported keys:
MAC_NOTIFY_MODEOPENCLAW_NOTIFY_CHANNELOPENCLAW_NOTIFY_TARGETOPENCLAW_NOTIFY_SELF_TARGET
- Reject malformed lines, unknown keys, command substitutions, and unsupported values.
- Create the configuration file with mode
0600and verify that it is owned by the current user before reading it. - Reject symbolic links and files writable by group or other users.
- Validate each value according to its expected syntax before passing it to OpenClaw.
- Consider using JSON and a non-executing parser such as Python's
jsonmodule instead of shell-formatted configuration.
- Do not use