T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:64
- Finding
- Persistent Shell Code Execution Through Unsafe Environment File Sourcing## Vulnerability Details **File Location**: `SKILL.md`, lines 64–78 and 84–88 **Vulnerability Type**: Unsafe shell evaluation of a writable configuration file **Risk Level**: Medium ### Vulnerable Code ```bash ### 4. Auto-Load .env (Optional but Recommended) **For OpenClaw sessions:** Add to your `~/.bashrc` or `~/.zshrc`: ```bash # Auto-load telegram-direct-send env vars if [ -f "$HOME/.openclaw/workspace/skills/telegram-direct-send/.env" ]; then source "$HOME/.openclaw/workspace/skills/telegram-direct-send/.env" fi ``` ``` The alternative wrapper repeats the unsafe behavior: ```bash #!/bin/bash # Load env vars from skill directory SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" if [ -f "$SCRIPT_DIR/.env" ]; then source "$SCRIPT_DIR/.env" fi ``` ### Technical Analysis The Bash `source` command evaluates the complete contents of the specified file as shell code. It does not restrict the file to passive `KEY=VALUE` configuration entries. Consequently, any command, function definition, command substitution, redirection, or other shell construct inserted into `.env` will execute with the privileges of the user running the shell. Recommending that users add this operation to `~/.bashrc` or `~/.zshrc` expands the risk beyond an individual Skill invocation. The Skill only needs two values, `TELEGRAM_BOT_TOKEN` and `TELEGRAM_CHAT_ID`, during a send operation. Executing arbitrary contents from the Skill directory whenever a shell starts is unnecessary for that functionality and violates least-privilege principles. The project also claims that `.env` is excluded by `.gitignore`, but no `.gitignore` is present in the audited package. This does not directly cause command execution, but it weakens the documented protection against accidental credential disclosure. ### Attack Path 1. A local attacker, compromised process, malicious update, or another component with write access modifies `$HOME/.openclaw/workspace/skills/telegram-direct ...[truncated 1215 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the recommendation to source the Skill’s `.env` from `~/.bashrc` or `~/.zshrc`. 2. Load credentials only for the duration of an explicit send operation. 3. Parse the configuration as data rather than evaluating it as shell code. Accept only exact keys such as `TELEGRAM_BOT_TOKEN` and `TELEGRAM_CHAT_ID`, reject malformed lines, and never use `eval`. 4. Prefer a credential manager or OpenClaw-supported secret facility over a plaintext `.env` file. 5. If a local secret file remains supported: - Require restrictive permissions such as `chmod 600 .env`. - Verify that the file is owned by the current user. - Ensure the containing directory is not writable by untrusted users. - Add an actual `.gitignore` entry for `.env`. 6. Avoid exporting the Telegram token globally. Pass it only to the process that performs the Telegram request. 7. Document that shell tracing and command logging must remain disabled because Telegram requires the bot token in the API URL.