T09 · Insecure Skill Coding Practices
Error
- Location
- references/openclaw-secrets.md:13
- Finding
- Arbitrary Command Execution Through Exec-Based Secret References## Vulnerability Details **File Location**: `references/openclaw-secrets.md:13-19, 21-25, 37-45, 54-56` **Vulnerability Type**: Command injection through attacker-controlled secret reference configuration **Risk Level**: High ### Vulnerable Code ```text The CLI accepts a compact JSON object in `MASSIVE_API_KEY_REF` and resolves it before issuing any network request. Supported `source` values: - `env`: read a named environment variable - `file`: read a file path and trim the trailing newline - `exec`: execute a command and use stdout as the secret, matching OpenClaw's SecretRef model Supported keys by source: - `env`: `name` or `key` - `file`: `path` - `exec`: `command` or `cmd` ``` ```json {"source":"exec","command":"op read op://shared/massive/api-key"} ``` ```text ## Resolution Rules 1. Parse `MASSIVE_API_KEY_REF` as JSON. 2. Resolve the referenced value. 3. Fail before making the request if the reference cannot be resolved. 4. Fall back to `MASSIVE_API_KEY` only when `MASSIVE_API_KEY_REF` is unset. ``` ```text ## Alignment Note `exec` refs are intentionally supported to stay aligned with OpenClaw Secrets Management. Keep that behavior documented and assume the surrounding runtime is responsible for provider sandboxing and policy enforcement. ``` ### Technical Analysis The documented SecretRef contract accepts a command from the `MASSIVE_API_KEY_REF` environment variable and executes it to obtain a secret. This exposes a general command-execution interface where only credential retrieval is required. If the command is passed to a shell, command substitutions, separators, redirections, pipelines, or other shell syntax could execute arbitrary operations. Even if it is parsed without a shell, permitting an unrestricted executable and unrestricted arguments still allows invocation of tools unrelated to secret retrieval. The documentation delegates sandboxing and policy enforcement to ...[truncated 1738 chars]
- Remediation
- ## Remediation Suggestions 1. Remove support for the `exec` SecretRef source from the Skill. 2. Prefer runtime-resolved secrets so the Skill receives only the resulting credential, not an executable command. 3. If command-based providers are unavoidable, map fixed provider identifiers to hardcoded executable paths and fixed argument structures. 4. Do not pass configuration text to `eval`, `bash -c`, `sh -c`, or equivalent shell interpreters. 5. Reject shell metacharacters, substitutions, redirections, and unapproved executables. 6. Execute approved providers with a minimal environment, restricted working directory, short timeout, disabled network access where possible, and least-privileged identity. 7. Add tests proving that unapproved executables and shell payloads are rejected. 8. Include `scripts/massive` in the artifact and audit its exact parsing and execution behavior before distribution.