T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:29- Finding
Unsafe Shell Interpolation in Mandatory Analytics Logging
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 29–40
Vulnerability Type: Command injection and plaintext retention of request context
Risk Level: HighVulnerable Code
markdown ## 📊 Analytics — MANDATORY: Log Every Skill Use **This step is NOT optional.** Before starting any skill, append one line: ```bash mkdir -p /opt/ocana/openclaw/workspace/data echo "{\"ts\":\"$(date -u +%Y-%m-%dT%H:%M:%SZ)\",\"skill\":\"SKILL_NAME\",\"trigger\":\"TRIGGER\",\"context\":\"CONTEXT\"}" \ >> /opt/ocana/openclaw/workspace/data/skill-analytics.jsonlReplace:
SKILL_NAME→ the skill selected (e.g.meetings)TRIGGER→ the phrase that matched (e.g.schedule meeting with Daniel)CONTEXT→dm,group:<name>, orcron
text ### Technical Analysis The skill requires the agent to construct and execute a shell command after replacing `SKILL_NAME`, `TRIGGER`, and `CONTEXT` with runtime values. At least the trigger and group name can contain user-controlled text. These values are placed directly inside a double-quoted shell argument without shell escaping. Double quotes do not suppress shell command substitution. If a substituted value contains syntax such as `$(command)` or backticks, the shell can evaluate that syntax before `echo` writes the record. Quotes, backslashes, and newline characters can also corrupt the generated command or JSONL structure. The command additionally stores request-derived context in plaintext at the fixed path `/opt/ocana/openclaw/workspace/data/skill-analytics.jsonl`. No redaction, data-minimization policy, restrictive file permissions, retention limit, or consent control is specified. Consequently, sensitive information embedded in a trigger may be retained and exposed to other local users or analytics consumers with access to that file. ### Attack Path 1. An attacker sends a request whose matching phrase or context includes shell substitution sy ...[truncated 1670 chars]- Remediation
View remediation
Remediation Suggestions
- Do not generate a shell command by interpolating request-derived text. Implement logging through a structured API or script that receives values as data rather than executable shell source.
- Serialize records with a standard JSON library to ensure quotes, backslashes, control characters, and newlines are escaped correctly.
- If a shell wrapper is unavoidable, pass values as positional arguments to a fixed script and quote each argument safely. Do not use
eval, command-string construction, or direct textual substitution. - Validate
SKILL_NAMEagainst a strict allowlist of installed skill identifiers. - Restrict
CONTEXTto an explicit schema and validate group identifiers rather than accepting arbitrary shell text. - Avoid storing the full trigger phrase. Record a predefined trigger identifier or a redacted, length-limited summary instead.
- Remove credentials, tokens, personal data, and other sensitive values before persistence.
- Create the analytics file with restrictive permissions, such as owner-only access, and verify the containing directory is not writable by untrusted users.
- Define retention and deletion controls and disclose analytics collection to the owner rather than making unrestricted logging mandatory.
- Add tests using payloads containing
$(), backticks, quotes, backslashes, newlines, and JSON control characters to verify they remain inert data.