T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:7
- Finding
- Arbitrary Shell Execution Through Sourced Context File## Vulnerability Details **File Location**: `SKILL.md`, lines 7–10 **Vulnerability Type**: Unsafe execution of a local configuration file **Risk Level**: High ### Vulnerable Code ```bash CONTEXT_FILE="/opt/ocana/openclaw/workspace/skills/eval/.context" [ -f "$CONTEXT_FILE" ] && source "$CONTEXT_FILE" # Then use: $OWNER_PHONE, $WORKSPACE, $TASKS_FILE, $MONDAY_TOKEN_FILE, $GOG_CREDS, etc. ``` ### Technical Analysis The shell `source` command interprets the entire `.context` file as executable shell code rather than parsing it as inert configuration data. Consequently, the file may contain arbitrary commands, command substitutions, redirections, function definitions, or environment modifications. If an attacker or compromised local process can modify this context file, triggering the Skill causes the injected commands to execute with the same operating-system privileges and environment as the Agent. The instruction also loads potentially sensitive values—including an owner phone number, API-token locations, and credential references—without establishing that every value is required for the evaluation. This unnecessarily increases secret exposure and the impact of injected code. The issue is conditional on an attacker obtaining write access to `.context` or its parent directory. The reviewed Skill does not itself grant that access. ### Attack Path 1. An attacker or compromised local process obtains write access to `/opt/ocana/openclaw/workspace/skills/eval/.context`. 2. The attacker inserts a shell payload into the file, such as a command that reads credentials, modifies workspace files, or sends collected data over the network. 3. The owner invokes the evaluation Skill. 4. The Agent follows the initialization instruction and executes `source "$CONTEXT_FILE"`. 5. The shell interprets the attacker's payload under the Agent's identity and permissions. 6. The payload can access files, credentials, environment variables, and network resources available to the A ...[truncated 809 chars]
- Remediation
- ## Remediation Suggestions 1. **Do not execute the context file.** Replace `source` with a parser that treats the file strictly as data. 2. **Use an explicit key allowlist.** Accept only configuration keys required by the current operation, such as `WORKSPACE` or `TASKS_FILE`, and reject unexpected entries. 3. **Reject shell syntax.** Disallow command substitutions, backticks, redirections, control operators, function definitions, multiline values, and executable statements. 4. **Load secrets only when required.** Do not import phone numbers, API-token paths, or credential references for checks that do not need them. 5. **Validate file security before reading.** Confirm that the file is a regular file, is owned by the expected account, is not a symbolic link, and is not writable by group or other users. 6. **Apply least privilege.** Run the Skill under an account with access only to the files and network destinations needed for evaluation. 7. **Prefer structured configuration.** Store non-secret settings in JSON or another format parsed by a non-executing parser. Retrieve secrets from a dedicated secret manager at the point of use. 8. **Document the trust boundary.** Explicitly state who may modify the context file and ensure its parent directories have restrictive permissions.