T09 · Insecure Skill Coding Practices
- Location
SKILL.md:10- Finding
Arbitrary Shell Execution Through Sourced Context File
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 10–13
Vulnerability Type: Unsafe shell sourcing of an external configuration file
Risk Level: HighComplete Code Snippet:
bash CONTEXT_FILE="/opt/ocana/openclaw/workspace/skills/meeting-notetaker/.context" [ -f "$CONTEXT_FILE" ] && source "$CONTEXT_FILE" # Then use: $OWNER_EMAIL, $CALENDAR_ID, $GOG_CREDS, etc.Technical Analysis
The
sourceshell built-in executes the contents of.contextin the current shell rather than treating the file as passive configuration data. The file resides outside the reviewed project, and the Skill does not require verification of its ownership, permissions, integrity, or syntax before execution.Consequently, any shell construct placed in
.context—including command substitutions, redirections, function definitions, or direct commands—will run with the privileges and environment of the process invoking the Skill. Merely checking that the file exists does not establish that it is trusted.Attack Path
- An attacker or compromised process obtains write access to
/opt/ocana/openclaw/workspace/skills/meeting-notetaker/.context. - The attacker inserts arbitrary shell commands into that file, such as commands that read credentials or transmit sensitive data.
- A user invokes the Meeting Notetaker Skill.
- The initialization instructions execute
source "$CONTEXT_FILE". - The injected commands execute in the current shell with the Agent's effective privileges.
Exploitation depends on an attacker being able to modify the external context file; its permissions and ownership were not available for review.
Impact Assessment
Successful exploitation can provide arbitrary command execution with the invoking Agent's effective privileges. The resulting scope may include access to environment variables, local files readable by the Agent, monday.com or Google credentials available to the process, ...[truncated 226 chars]
- An attacker or compromised process obtains write access to
- Remediation
View remediation
Remediation Suggestions
- Do not use
sourceto load configuration data. - Store configuration in a non-executable format such as JSON or a strictly defined environment file.
- Parse the file with a non-shell parser and allowlist only required keys, such as
OWNER_EMAIL,CALENDAR_ID, andGOG_CREDS. - Reject unknown keys, shell metacharacters, command substitutions, malformed values, and duplicate entries.
- Before reading the file, verify that it is a regular file, is owned by the expected account, is not a symbolic link, and is not writable by group or other users.
- Minimize loaded values; replace the open-ended reference to “etc.” with an explicit list of required fields.
- Prefer a dedicated secrets or credential provider for sensitive values, and expose only the specific credentials required for the requested operation.
- Run the Skill under a restricted service account with narrowly scoped filesystem and network permissions to reduce impact if configuration integrity is compromised.
- Do not use