T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:7
- Finding
- Raw Shell Execution Exceeds the Skill's Required Privileges<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:7-10` **Vulnerability Type**: Raw command execution and command-injection exposure **Risk Level**: High ### Vulnerable Code ```yaml command-dispatch: tool command-tool: exec command-arg-mode: raw metadata: {"openclaw": {"emoji": "🐾", "requires": {"bins": ["curl"], "env": ["SOLPAW_API_KEY", "SOLPAW_CREATOR_WALLET", "SOLANA_PRIVATE_KEY"], "config": []}, "primaryEnv": "SOLPAW_API_KEY", "install": []}} ``` ### Technical Analysis The Skill configures its command interface to dispatch raw arguments to the general-purpose `exec` tool. No command-specific parser, argument allowlist, escaping layer, or typed wrapper is included in the project. Token creation requires only constrained API operations and does not inherently require unrestricted shell execution. Consequently, this configuration grants substantially broader privileges than the declared functionality requires. If untrusted token metadata, user input, or prompt-injected content is incorporated into a command, shell metacharacters may be interpreted as executable syntax rather than inert data. The exact exploitability depends on how the host OpenClaw runtime implements raw `exec` dispatch, but the project itself provides no mitigating validation. ### Attack Path 1. An attacker supplies token metadata or instructions containing shell syntax, such as command separators, substitutions, or redirections. 2. The agent constructs or invokes the Skill's `launch` command using the attacker-controlled text. 3. Because `command-arg-mode` is `raw` and the command tool is `exec`, the text may reach a shell command context without structured parsing. 4. Shell syntax is interpreted by the operating system. 5. The injected command executes with the same operating-system privileges and environment access as the OpenClaw process. ### Impact Assessment Successful exploitation could permit arbitrary command execution under the agent's account. This may expo ...[truncated 383 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove `command-tool: exec` and `command-arg-mode: raw`. 2. Expose a typed tool whose schema separately defines `name`, `symbol`, `description`, wallet address, transaction signature, and numeric launch parameters. 3. Call the API directly from TypeScript rather than constructing shell commands. 4. Apply strict validation: - Enforce documented length limits. - Restrict symbols to the documented alphanumeric format. - Validate Solana addresses and transaction signatures. - Validate numeric ranges for purchase amount, slippage, and priority fee. - Require HTTPS for user-provided URLs. 5. If a subprocess is unavoidable, invoke a fixed executable with an argument array and no shell, rather than interpolating values into a command string. 6. Run the Skill under a restricted account with a minimal environment and no wallet private key. ]]>