T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/remove-agent.sh:32
- Finding
- Destructive Path Traversal in Agent Removal<![CDATA[ ## Vulnerability Details **File Location**: `scripts/remove-agent.sh`, lines 32–43 and 67–83 **Vulnerability Type**: Path traversal leading to arbitrary recursive deletion **Risk Level**: High ### Vulnerable Code ```bash AGENT_ID="${1:-}" FORCE_FLAG="" if [ "$2" = "--force" ]; then FORCE_FLAG="--force" fi if [ -z "$AGENT_ID" ]; then echo -e "${RED}Error: Missing agent-id${NC}" exit 1 fi OPENCLAW_HOME="${OPENCLAW_HOME:-$HOME/.openclaw}" AGENTS_DIR="$OPENCLAW_HOME/agents" WORKSPACE_DIR="$OPENCLAW_HOME/workspace" AGENT_WORKSPACE="$WORKSPACE_DIR/workspace-$AGENT_ID" ``` ```bash # Step 2: Remove agent directory echo -e "${BLUE}2. Removing agent directory...${NC}" if [ -d "$AGENTS_DIR/$AGENT_ID" ]; then rm -rf "$AGENTS_DIR/$AGENT_ID" echo " Removed: $AGENTS_DIR/$AGENT_ID" fi # Step 3: Remove workspace directory echo -e "${BLUE}3. Removing workspace...${NC}" if [ -d "$AGENT_WORKSPACE" ]; then rm -rf "$AGENT_WORKSPACE" echo " Removed: $AGENT_WORKSPACE" fi ``` ### Technical Analysis `AGENT_ID` is validated only for being nonempty. It is then appended directly to filesystem paths passed to `rm -rf`. Shell quoting prevents word splitting and glob expansion, but it does not prevent path traversal through components such as `../`. The `-d` checks do not provide a security boundary. If a traversal-derived path resolves to an existing directory, the check succeeds and the directory is recursively deleted. The optional `--force` argument removes the interactive confirmation barrier. ### Attack Path 1. An attacker, malicious prompt, or compromised agent causes the removal script to be invoked with an identifier containing traversal components. 2. The script constructs deletion targets such as: ```text $OPENCLAW_HOME/agents/../../../target ``` 3. Filesystem path resolution moves outside the intended `agents` directory. 4. The `-d` check succeeds if the resolved target exists. 5. `rm -rf` recursively deletes the resolved ...[truncated 795 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enforce a strict agent identifier format before constructing paths: ```bash if [[ ! "$AGENT_ID" =~ ^[a-z0-9]+(-[a-z0-9]+)*$ ]]; then echo "Invalid agent ID" >&2 exit 1 fi ``` 2. Canonicalize both the allowed root and deletion target using `realpath`. 3. Verify that each canonical target is a strict descendant of its expected root before deletion. 4. Explicitly reject empty targets, root directories, `.` and `..` components, path separators, and symlink-based escapes. 5. Refuse to remove symlink targets unless symlink behavior is deliberately supported and securely implemented. 6. Avoid allowing automated agents to use `--force`; require explicit user approval for destructive operations. 7. Display the canonical deletion paths during confirmation. 8. Add tests covering traversal identifiers, absolute-looking inputs, symlinks, empty values, and valid hyphenated identifiers. ]]>