T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:106- Finding
Command Injection Through User-Controlled Prompt Interpolation
- Content
View full analysis
"" ``` ```bash herdr pane run "" ``` ```bash herdr pane run "" ``` ```bash -p "" ``` ### Technical Analysis The skill instructs the agent to insert Telegram messages, prompts, replies, and questions directly into quoted shell command templates. These values are attacker-controlled. Double quotes do not make arbitrary data safe for inclusion in a shell command. Shell constructs such as command substitution using `$(...)` or backticks remain active inside double quotes. An attacker may also attempt to terminate the quoted argument and append additional shell syntax. If the agent constructs these examples as command strings and executes them through a shell, shell expansion occurs before `herdr` or the selected agent binary receives the argument. Consequently, malicious content intended to be treated as terminal text can instead execute as a local operating-system command. The same underlying defect affects both the persistent Herdr pane workflow and the documented headless alternative. ### Attack Path 1. An attacker submits a Telegram prompt, reply, or one-shot question containing shell syntax, such as a command substitution payload. 2. The skill places the input into one of the documented command templates without robust shell escaping. 3. The resulting command string is passed to a shell by the agent or command-execution environment. 4. The shell evaluates the injected substitution or appended command before invoking `herdr` or the selected CLI agent. 5. The injected operating-system command executes with the privileges and environment of the OpenClaw gateway process. 6. T ...[truncated 1204 chars]- Remediation
View remediation