T09 · Insecure Skill Coding Practices
- Location
SKILL.md:217- Finding
Automatic Execution of Repository-Controlled npm Scripts
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 217–234
Vulnerability Type: Automatic, unsandboxed execution of untrusted package scripts
Risk Level: MediumVulnerable Code
bash # Check build if applicable if [[ -f "package.json" ]]; then if npm run build > /dev/null 2>&1; then echo "✅ Build passes" else echo "⚠️ Build has errors" fi fi # Check for new errors if [[ -f "package.json" ]]; then if npm test > /dev/null 2>&1; then echo "✅ Tests pass" else echo "⚠️ Tests have failures" fi fiTechnical Analysis
The skill treats the presence of
package.jsonas sufficient authorization to executenpm run buildandnpm test. npm scripts are repository-controlled shell commands and can perform arbitrary actions with the privileges and environment of the OpenClaw process.The implementation does not inspect the selected scripts, verify that the repository is trusted, request user confirmation, restrict filesystem or network access, or run the commands in a sandbox. Redirecting both standard output and standard error to
/dev/nullfurther reduces visibility into malicious behavior.Attack Path
- An attacker creates or modifies a repository containing a
package.json. - The attacker defines a malicious
build,test,prebuild,pretest, or related npm lifecycle script. - A user opens the repository and invokes Ultrawork for an otherwise legitimate task.
- After the delegated tasks finish, the verification phase detects
package.json. - The skill automatically invokes
npm run buildandnpm test. - npm executes the attacker-controlled scripts and applicable lifecycle hooks without requesting confirmation.
- The malicious commands run with the invoking process's permissions while their output is suppressed.
Impact Assessment
Successful exploitation permits arbitrary command execution under the operatin ...[truncated 631 chars]
- An attacker creates or modifies a repository containing a
- Remediation
View remediation
Remediation Suggestions
- Require explicit user approval before running any repository-defined package script, showing the exact script name and resolved command.
- Inspect
package.jsonforbuild,test, and associated lifecycle hooks such asprebuild,postbuild,pretest, andposttest. - Provide a default-safe mode that skips repository-controlled verification commands unless the repository has been explicitly trusted.
- Execute verification inside a restricted container or sandbox with a read-only source mount, minimal environment variables, no sensitive host mounts, limited process privileges, and network access disabled unless required.
- Do not suppress all output. Preserve command, exit status, standard output, and standard error in an auditable log while applying secret redaction where necessary.
- Support an allowlist of approved verification commands rather than assuming every
package.jsonis trustworthy. - Enforce time, process, filesystem, and resource limits on verification commands.