T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:10
- Finding
- Arbitrary Shell Command Execution Through an Unvalidated Context File## Vulnerability Details **File Location**: `SKILL.md`, lines 10–12 **Vulnerability Type**: Unsafe shell sourcing of a mutable local configuration file **Risk Level**: High ### Vulnerable Code ```bash CONTEXT_FILE="/opt/ocana/openclaw/workspace/skills/billing-monitor/.context" [ -f "$CONTEXT_FILE" ] && source "$CONTEXT_FILE" # Then use: $OWNER_PHONE, $ADMIN_PHONE, $BILLING_LOG, $BILLING_FALLBACK_CONFIG, etc. ``` ### Technical Analysis The `source` shell builtin evaluates the entire contents of `.context` as shell code in the current process. It does not restrict the file to variable assignments. Consequently, the file can contain command substitutions, function definitions, redirections, external command invocations, environment modifications, or other arbitrary shell operations. The skill verifies only that the file exists. It does not validate: - File ownership or group ownership - File permissions - Symbolic-link status - File integrity - The syntax or allowed fields in the file - Whether values contain executable shell expressions This creates an arbitrary-command-execution primitive if an attacker or compromised local process can create, replace, or modify the fixed `.context` file. Commands run with the identity and permissions of the account executing the skill. ### Attack Path 1. An attacker obtains write access to the `.context` file, its containing directory, or a mechanism capable of replacing the file. 2. The attacker inserts shell commands into the file, for example a command that reads API-key environment variables or modifies OpenClaw configuration. 3. The billing-monitor skill is invoked during an API failure, health check, or other documented trigger. 4. The initialization instructions execute `source "$CONTEXT_FILE"`. 5. The attacker's statements execute within the agent's shell context and inherit its environment and permissions. 6. The attacker can access or alter resources availabl ...[truncated 998 chars]
- Remediation
- ## Remediation Suggestions 1. Do not load configuration by using `source`, `.`, `eval`, or command substitution. 2. Store configuration in a non-executable format such as JSON. 3. Parse an explicit allowlist of expected fields with a safe parser. Reject unknown keys, invalid types, control characters, and malformed values. 4. Before reading the file, verify that it is a regular file rather than a symbolic link and that it is owned by the expected account. 5. Require restrictive permissions, such as mode `0600` for the file and a non-writable parent directory for untrusted users. 6. Where integrity guarantees are required, provision the file through a trusted deployment mechanism and verify its digest or signature before use. 7. Keep secrets in an operating-system credential store or dedicated secret manager rather than an executable context file. 8. Pass validated values to commands as quoted arguments and independently validate model identifiers, paths, phone numbers, and channel names before use. A safer JSON-loading pattern is: ```bash CONTEXT_FILE="/opt/ocana/openclaw/workspace/skills/billing-monitor/context.json" [ -f "$CONTEXT_FILE" ] || exit 1 [ ! -L "$CONTEXT_FILE" ] || exit 1 OWNER_PHONE="$( python3 -c 'import json, sys; print(json.load(open(sys.argv[1]))["owner_phone"])' \ "$CONTEXT_FILE" )" ``` The implementation should additionally perform ownership, permission, schema, and value validation before consuming any parsed field.