T09 · Insecure Skill Coding Practices
- Location
skills/benchmark/SKILL.md:5- Finding
Unrestricted General-Purpose Shell Dispatch
- Content
View full analysis
Vulnerability Details
File Location:
skills/benchmark/SKILL.md:5-7andskills/doctor/SKILL.md:5-7
Vulnerability Type: Unrestricted command execution configuration
Risk Level: HighVulnerable Code
skills/benchmark/SKILL.md:1-8:yaml --- name: clawbrain-pro-benchmark description: Tests OpenClaw across 205 realistic scenarios and compares its performance with the ClawBrain v1.0 orchestration engine user-invocable: true command-dispatch: tool command-tool: exec metadata: {"openclaw": {"emoji": "📊", "requires": {"bins": ["curl"]}}} ---skills/doctor/SKILL.md:1-8:yaml --- name: clawbrain-pro-doctor description: Diagnoses OpenClaw configuration and runtime health user-invocable: true command-dispatch: tool command-tool: exec metadata: {"openclaw": {"emoji": "🩺", "requires": {"bins": ["curl"]}}} ---Technical Analysis
Both user-invocable skills dispatch directly to the general-purpose
exectool. Neither file specifies a fixed executable, bundled diagnostic script, command allowlist, argument schema, validation procedure, or shell metacharacter filtering.This violates least-functionality principles: benchmark and health-check operations only require a small, predetermined set of read-only commands, but the configuration exposes a general shell execution interface. If OpenClaw forwards invocation text or generated arguments to
exec, crafted input could alter the intended command through shell metacharacters, command substitution, pipes, redirection, or additional arguments.The package does not include implementation code proving exactly how the framework constructs the final command. Exploitability therefore depends on OpenClaw's
command-dispatchsemantics and any validation performed outside this package. Nevertheless, exposingexecwithout a constrained command definition creates a dangerous execution boundary.Attack Path
- An attack ...[truncated 1069 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove
command-dispatch: toolandcommand-tool: execif these skills are intended only to provide documentation. - Replace general-purpose execution with a bundled, reviewed script that performs only the required read-only checks.
- Invoke executables directly through an argument-array API rather than through a shell.
- Define an explicit command and argument allowlist; reject unknown options and positional arguments.
- Do not accept shell metacharacters, redirection operators, command substitution, or arbitrary environment-variable assignments.
- Run diagnostics under a dedicated low-privilege account with restricted filesystem and network access.
- Avoid exposing environment secrets to the diagnostic process.
- Add tests proving that inputs containing
;,|,&&, backticks,$(), newlines, and redirection cannot alter command execution. - Apply the same correction to
skills/doctor/SKILL.md:5-7.
- Remove