T09 · Insecure Skill Coding Practices
Error
- Location
gatekeeper.ts:258- Finding
OS Command Injection Through an Unvalidated Installation Slug
- Content
View full analysis
{ console.log(`\n📦 安裝技能: ${slug}`) console.log(` 🔒 自動進入安全審核...`) // 使用 clawhub 安裝 const { execSync } = await import("child_process") try { execSync(`node "C:/Users/ReaMasTer/AppData/Roaming/npm/node_modules/clawhub/bin/clawdhub.js" install ${slug} --dir "${SKILL_DIR}"`, { encoding: "utf-8" }) ``` The untrusted value originates from the command-line arguments: ```ts if (command === "install" && args[1]) { const success = await installWithAudit(args[1]) ``` ### Technical Analysis The `slug` value is accepted directly from `process.argv` and interpolated into a command string passed to `execSync`. By default, `execSync` executes its string through a system shell. Consequently, shell metacharacters contained in `slug` are interpreted as command syntax rather than as part of a single installation argument. No validation, escaping, or strict identifier allowlist is applied before the value reaches the shell. Quoting only `SKILL_DIR` does not protect the separately interpolated `slug`. This vulnerability is particularly serious because the injected command executes before the newly installed Skill is audited. The security scanner therefore cannot prevent exploitation of the Gatekeeper itself. ### Attack Path 1. An attacker supplies or recommends a crafted Skill slug containing shell control syntax. 2. A user or automation invokes `skill-gatekeeper install` with that slug. 3. `main()` forwards the untrusted argument to `installWithAudit()`. 4. `installWithAudit()` inserts the value into the command string without validation. 5. The operating-system shell parses the injected syntax. 6. Attacker-controlled commands execute with the same permissions and environment as the Gatekeeper process. 7. Ex ...[truncated 735 chars]- Remediation
View remediation