T09 · Insecure Skill Coding Practices
Error
- Location
install.sh:39- Finding
Shell Command Injection Through Installer Configuration
- Content
View full analysis
/dev/null)" fi ``` ```bash SEND_PROMPT="$(sed -e "s|{{WORKSPACE}}|$WS|g" -e "s|{{SESSIONS_JSON}}|$SESSIONS_JSON|g" "$SCRIPT_DIR/templates/send-job-prompt.txt")" SEND_CMD="openclaw cron add --name idle-ping-send --declaration-key idle-ping-send --at 2036-01-01T00:00:00Z --session isolated --timeout-seconds 600 --light-context --disabled --keep-after-run --announce --channel telegram --to '$TELEGRAM_ID' --message \"\$SEND_PROMPT\" --json" [ -n "$MODEL" ] && SEND_CMD="openclaw cron add --name idle-ping-send --declaration-key idle-ping-send --at 2036-01-01T00:00:00Z --session isolated --timeout-seconds 600 --light-context --disabled --model '$MODEL' --announce --channel telegram --to '$TELEGRAM_ID' --message \"\$SEND_PROMPT\" --json" if [ "$DRY" = "1" ]; then echo " [dry-run] $SEND_CMD" else SEND_OUT="$(eval "$SEND_CMD" 2>/dev/null)" fi ``` ```bash CRAWLER_CMD="openclaw cron add --name idle-ping-crawler --declaration-key idle-ping-crawler --cron '15 * * * *' --tz '${IDLE_PING_TZ:-Asia/Hong_Kong}' --command 'python3 $WS/scripts/semantic-patrol.py --mode rotation' --command-env 'IDLE_PING_WS=$WS' --no-deliver --json" if [ "$DRY" = "1" ]; then echo " [dry-ru ...[truncated 2606 chars]- Remediation
View remediation
/dev/null)" ``` 3. Apply the same array-based pattern to send, pause, heartbeat, watchdog, crawler, topic-factory, and deep-explore job creation. 4. Pass prompts as direct array elements, such as `--message "$SEND_PROMPT"`, rather than embedding variable references inside command strings. 5. Validate configurable values before use: - Require a numeric Telegram chat identifier where applicable. - Allow only supported schedule formats. - Validate timezone names against an approved format or installed timezone database. - Restrict model names to the syntax accepted by OpenClaw. - Reject workspace or session paths containing control characters. 6. Replace the `run` helper with a function that receives arguments separately: ```bash run() { if [ "$DRY" = "1" ]; then printf ' [dry-run]' printf ' %q' "$@" printf '\n' else "$@" fi } ``` 7. Add regression tests containing quotes, semicolons, command substitutions, newlines, and redirection operators in every configurable input. Tests should verify that these values are rejected or passed literally and never executed. ]]>