T09 · Insecure Skill Coding Practices
Error
- Location
- run.sh:7
- Finding
- Arbitrary Code Execution Through Shell-Sourced Credential File<![CDATA[ ## Vulnerability Details **File Location**: `run.sh:7-11` **Vulnerability Type**: Shell execution through an untrusted configuration file **Risk Level**: High ### Vulnerable Code ```bash if [ -f "$SKILL_DIR/.env" ]; then set -a # shellcheck disable=SC1091 source "$SKILL_DIR/.env" set +a fi ``` ### Technical Analysis The `.env` file is loaded with Bash's `source` command. This does not parse the file as passive configuration; it executes every line as shell code with the privileges of the user running the Skill. A valid environment file only needs static `KEY=VALUE` assignments. Using `source` unnecessarily expands the trusted computing boundary and permits command substitutions, shell functions, redirections, and arbitrary commands. For example, a malicious `.env` could contain: ```bash LISTING_API_KEY="$(malicious-command)" ``` or direct shell commands unrelated to configuration. This behavior exceeds the minimum privileges needed to load API settings. Although the audited template itself contains only static assignments, exploitation becomes possible if another account, compromised installation process, archive extraction, synchronization mechanism, or local process can alter `.env`. ### Attack Path 1. An attacker gains the ability to modify or replace the Skill's `.env` file. 2. The attacker inserts shell commands or command substitutions into the file. 3. A user invokes `run.sh`. 4. Bash executes the attacker-controlled content through `source`. 5. The commands inherit the invoking user's filesystem access, environment variables, network access, and other available privileges. ### Impact Assessment Successful exploitation provides arbitrary command execution as the user running OpenClaw or the Skill. The attacker could read accessible credentials, alter workspace files, execute network requests, or compromise other resources available to that account. This code does not itself elevate privileges to root, so the ultimate scope re ...[truncated 53 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not use `source`, `.`, `eval`, or command substitution to load credential files. - Parse the file as data with a strict allowlist of expected names: - `LISTING_API_KEY` - `LISTING_BASE_URL` - `LISTING_MODEL` - `COZE_TOKEN` - `COZE_WORKFLOW_ID` - `COZE_API_URL` - `MIHE_KEY` - Reject malformed lines, duplicate keys, shell metacharacters, command substitutions, and unexpected variable names. - Prefer loading the file inside Python using the existing non-executing parser. - Require restrictive permissions such as `0600` and verify that the file is owned by the expected user before reading it. - Avoid automatically trusting configuration files copied or modified by other processes. ]]>