T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:37- Finding
Shell Command Injection Through Unsafe Message Interpolation
- Content
View full analysis
" --agent main --json ``` ```bash openclaw agent --message "HANDOFF od Claude Code: $(cat /path/to/.continue-here.md)" --agent main --json ``` ```bash openclaw agent --message "..." --agent main --json | python3 -c " import json, sys d = json.load(sys.stdin) for p in d['result']['payloads']: if p['text']: print(p['text']) " ``` ### Technical Analysis The skill instructs Claude Code to interpolate message content directly into a Bash command enclosed in double quotes. Double quotes do not make arbitrary input safe for shell command construction. If untrusted message content contains a double quote followed by shell syntax, it can terminate the intended argument and introduce command separators, redirections, or command substitutions. For example, a message containing syntax conceptually equivalent to: ```text "; attacker_command; # ``` could transform the generated command into multiple shell operations if the agent follows the documented template literally. The explicit `$(cat ...)` handoff example also normalizes shell command substitution as part of message construction. Although that particular example uses a fixed path placeholder, adapting it with an attacker-influenced path would create an additional injection or unauthorized file-read risk. The skill's declared tool scope is `Bash(openclaw:*)`. The practical exploitability may depend on how the host enforces that tool restriction, but the generated shell command itself is unsafe and must not rely on tool-policy matching as an input-sanitization boundary. ### Attack Path 1. An attacker supplies or influences text used in an “ask openclaw,” “tell rook,” or handoff request. 2. The message includes a closing quotation mark and additional shell syntax. 3. Claude Code follows th ...[truncated 833 chars]- Remediation
View remediation