T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:84- Finding
Arbitrary Python Code Execution Through Unsafe Directory-Name Interpolation
- Content
View full analysis
/dev/null) ``` ### Technical Analysis The `group_dir` shell variable is interpolated directly into Python source code passed to `python3 -c`. Although the shell loop safely quotes the path for ordinary filesystem operations, the value is not escaped as a Python string literal. Unix directory names may contain single quotes, commas, parentheses, and other Python syntax characters. A maliciously named directory can therefore terminate the string passed to `open()` and inject an additional Python expression. For example, a name structured like the following can introduce a function call while Python evaluates the arguments to `open()`: ```text x',__import__('os').system('ATTACKER_COMMAND'),' ``` When substituted into the command, the injected expression is evaluated by Python. Suppressing standard error with `2>/dev/null` can also conceal syntax errors or runtime errors generated after the payload has run. This vulnerability becomes exploitable whenever an attacker, compromised integration, or lower-trust process can create or rename a directory beneath: ```text $HOME/.openclaw/workspace/memory/whatsapp/groups/ ``` ### Attack Path 1. The attacker gains the ability to create or rename a WhatsApp group-memory directory under `memory/whatsapp/groups/`. This may occur through a group synchronization component, an import process, another compromised skill, or existing local write access. 2. The attacker creates a directory whose name contains Python syntax that closes the quoted path and inserts a function call. 3. T ...[truncated 1406 chars]- Remediation
View remediation
/dev/null) done ``` Additional hardening measures should include: 1. Prefer a standalone, reviewed Python script over dynamically supplied `python3 -c` source. 2. Validate that the resolved metadata path remains beneath the expected groups directory before opening it. 3. Reject unexpected group-directory names if upstream synchronization does not require arbitrary Unix filename characters. 4. Run the reporting workflow as a least-privileged account with access only to the required workspace files. 5. Avoid silently discarding all errors. Record sanitized failures in a protected diagnostic log so exploitation attempts and malformed metadata remain detectable. 6. Treat group names and metadata as untrusted data when including them in reports, logs, shell commands, or future prompts. ]]>