T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:27
- Finding
- Insufficient ZIP Archive Validation Before Skill Installation## Vulnerability Details **File Location**: `SKILL.md`, lines 27-42 **Vulnerability Type**: Unsafe archive extraction and insufficient package validation **Risk Level**: Medium ### Vulnerable Code Snippet ```markdown 1. Confirm the zip file exists. 2. Create a temporary extraction directory. 3. Unzip the package into the temporary directory. 4. Inspect the extracted content. 5. Validate that it looks like an OpenClaw skill: - must contain `SKILL.md` - may also contain `_meta.json`, `assets`, `agents`, `references` 6. Determine the correct active Skills directory for this OpenClaw installation. - Prefer `~/.openclaw/skills/` for shared local skills if appropriate. - If the current workspace has a dedicated `skills/` directory and the context indicates workspace-local installation, use that instead. 7. Determine the final skill folder name. 8. If the target folder already exists: - do not overwrite - report the existing path and stop 9. Move the extracted skill folder into the Skills directory. ``` ### Technical Analysis The installation procedure directs the agent to unzip an untrusted local package before defining mandatory archive-entry security checks. Its validation requirement is limited to confirming that the extracted package contains `SKILL.md`. The procedure does not require the agent to reject: - Absolute archive paths or entries containing `..` - Entries whose resolved paths escape the temporary extraction directory - Symbolic or hard links - Device nodes, sockets, or other special files - Excessive uncompressed sizes, compression ratios, file counts, or nesting depths - Packages containing multiple ambiguous root directories - Unexpected executable content - Malicious instructions embedded in the installed `SKILL.md` The instruction not to run scripts during installation reduces immediate execution risk but does not address filesystem attacks during extraction o ...[truncated 1952 chars]
- Remediation
- ## Remediation Suggestions 1. Enumerate all ZIP entries before extraction and reject absolute paths, drive-prefixed paths, empty or ambiguous names, and any entry containing a `..` component. 2. Resolve each intended destination path and verify that it remains strictly beneath the newly created temporary directory. 3. Reject symbolic links, hard links, device nodes, sockets, FIFOs, and other special file types. 4. Enforce limits on compressed size, total uncompressed size, compression ratio, entry count, individual file size, and directory depth. 5. Require exactly one well-formed skill root and reject unexpected content outside that root. 6. Create the temporary directory securely with restrictive permissions and guaranteed unique naming. 7. Extract with a library or tool configuration that does not follow links and cannot write outside the destination. 8. Validate the entire resulting filesystem tree again after extraction. 9. Review `SKILL.md` and all associated configuration, scripts, agents, assets, and references for dangerous instructions or executable behavior before activation. 10. Keep the package in a quarantine or staging directory until validation completes, and request explicit user confirmation before moving it into the active Skills directory. 11. Move the validated package atomically and without overwrite semantics. 12. Ensure cleanup only removes the exact temporary directory created by the installer.