T09 · Insecure Skill Coding Practices
Warning
- Location
- README.md:8
- Finding
- System-Wide Command Symlink Targets User-Writable Code## Vulnerability Details **File Location**: `README.md`, line 8 **Vulnerability Type**: System-wide executable linked to a user-writable script **Risk Level**: Medium ### Vulnerable Code ```bash sudo ln -sf ~/.openclaw/workspace/skills/a-stock-market/a-stock.py /usr/local/bin/a-stock ``` ### Technical Analysis The documented installation command uses elevated privileges to create `/usr/local/bin/a-stock` as a symbolic link to a script inside the installing user's workspace. That workspace and its script are ordinarily writable by the user without further administrative authorization. Consequently, the content executed through the system-wide command can be changed after installation without modifying `/usr/local/bin/a-stock` or obtaining elevated privileges again. The use of `ln -sf` also forcefully replaces an existing destination with the same name, which can unexpectedly alter an established system command. This creates a trust-boundary weakness when the command is subsequently invoked by another account, an administrator, or privileged automation. The script executes with the invoking process's privileges, not merely the privileges of the account that owns the symlink target. ### Attack Path 1. An administrator follows the installation instructions and runs the documented `sudo ln -sf` command. 2. `/usr/local/bin/a-stock` becomes a system-wide command pointing to the user-writable workspace script. 3. An attacker compromises the owning user account or otherwise obtains write access to `~/.openclaw/workspace/skills/a-stock-market/a-stock.py`. 4. The attacker replaces or modifies the script to contain arbitrary commands. 5. Another user, administrator, or privileged automated process invokes `/usr/local/bin/a-stock`. 6. The modified script executes with the privileges and access rights of that caller. Exploitation therefore depends on both write access to the symlink target and later execution by a more privileged or otherwise valuable caller. ### I ...[truncated 649 chars]
- Remediation
- ## Remediation Suggestions Install an immutable, root-owned copy of the script rather than a symbolic link to a user-writable workspace: ```bash sudo install -o root -g root -m 0755 a-stock.py /usr/local/bin/a-stock ``` Additional hardening measures should include: 1. Avoid `-f` replacement behavior unless overwriting the destination is explicitly intended. 2. Check whether `/usr/local/bin/a-stock` already exists before installation. 3. Verify the source file's integrity and ownership before copying it. 4. Ensure the installed file and its parent directory are not writable by unprivileged users. 5. Use a package manager or controlled deployment process for environments where privileged users or automation will invoke the command. 6. When updates are required, repeat an authenticated administrative installation rather than allowing the executable target to change through a user-writable link.