T09 · Insecure Skill Coding Practices
Warning
- Location
invoke.sh:13- Finding
Authenticated JSON-RPC Calls Are Not Restricted to Documented Methods
- Content
View full analysis
[params-json]}" DEFAULT_PARAMS='{}' PARAMS="${2:-$DEFAULT_PARAMS}" if ! printf '%s' "$METHOD" | grep -Eq '^[A-Za-z][A-Za-z0-9_]*$'; then echo "Invalid method: $METHOD" >&2 exit 2 fi ``` ```bash REQUEST_BODY="$(printf '{"jsonrpc":"2.0","id":1,"method":"%s","params":%s}' "$METHOD" "$PARAMS")" ``` ### Technical Analysis The method validation only verifies that the supplied value is a syntactically valid identifier. It does not verify that the method belongs to the documented set of operations in `SKILL.md`. Consequently, any method matching `^[A-Za-z][A-Za-z0-9_]*$` is inserted into the JSON-RPC request. The request is then transmitted with `X-OpenClaw-Key` whenever `BELONG_EVENTS_API_KEY` is configured. This exposes the authenticated backend RPC namespace to arbitrary method probing through the wrapper. The server may independently reject unknown or unauthorized methods, but relying solely on server-side controls creates unnecessary attack surface and conflicts with the script's documented claim that it validates method names. ### Attack Path 1. An attacker influences an agent instruction, tool argument, or local invocation of `invoke.sh`. 2. The attacker supplies an undocumented but syntactically valid method, for example: ```bash ./invoke.sh undocumented_admin_method '{}' ``` 3. The regular-expression check accepts the method because it contains only permitted identifier characters. 4. The wrapper constructs a JSON-RPC request containing that method. 5. If an API key is configured, the wrapper attaches it to the request. 6. The backend receives an authenticated request for an operation not exposed in the documented skill interface. 7. If the backend contains an undocumented method ...[truncated 682 chars]- Remediation
View remediation
&2 exit 2 ;; esac ``` The production implementation should include the complete supported method set from `SKILL.md`, preferably generated from a single authoritative manifest to prevent documentation drift. Additional hardening should include: - Enforcing method-level authorization on the remote server, regardless of client validation. - Returning a generic rejection response for unknown methods. - Monitoring repeated unknown-method requests as possible RPC enumeration. - Adding automated tests that verify every documented method is accepted and arbitrary methods are rejected. - Applying explicit per-method parameter schemas on the server. ]]>