T09 · Insecure Skill Coding Practices
Error
- Location
hooks/post-exec-log.sh:10- Finding
Unredacted command lines are written to a persistent audit log
- Content
View full analysis
/dev/null; then COMMAND=$(echo "$EVENT_DATA" | jq -r '.command // "unknown"') EXIT_CODE=$(echo "$EVENT_DATA" | jq -r '.exitCode // -1') DURATION=$(echo "$EVENT_DATA" | jq -r '.duration // 0') STDERR=$(echo "$EVENT_DATA" | jq -r '.stderr // ""' | head -c 200) else COMMAND=$(echo "$EVENT_DATA" | grep -o '"command"[[:space:]]*:[[:space:]]*"[^"]*"' | head -1 | sed 's/.*: *"//;s/"$//') EXIT_CODE=$(echo "$EVENT_DATA" | grep -o '"exitCode"[[:space:]]*:[[:space:]]*[0-9]*' | head -1 | sed 's/.*: *//') DURATION=$(echo "$EVENT_DATA" | grep -o '"duration"[[:space:]]*:[[:space:]]*[0-9]*' | head -1 | sed 's/.*: *//') STDERR="" fi ``` ```bash # 确定日志目录 WORKSPACE="${OPENCLAW_WORKSPACE:-.}" LOG_DIR="$WORKSPACE/memory" LOG_FILE="$LOG_DIR/hook-audit.log" # 确保目录存在 mkdir -p "$LOG_DIR" 2>/dev/null || true ``` ```bash # 写入审计日志 echo "[$TIMESTAMP] [PostExec] [$DECISION] [$STATUS] cmd=$COMMAND exit=$EXIT_CODE duration=${DURATION}ms" >> "$LOG_FILE" 2>/dev/null || true ``` ### Technical Analysis The hook extracts the complete command line from attacker-influenced event data and appends it verbatim to a persistent file. Command lines can contain API keys, passwords, bearer tokens, signed URLs, database connection strings, private filesystem paths, and other credentials. The hook does not: - Redact sensitive arguments or credential patterns. - Remove carriage returns, line feeds, or terminal control characters. - Apply a restrictive `umask` or explicitly set log-file permissions. - Define log rotation or retention limits. - Verify that `OPENCLAW_WORKSPACE` points to a trusted location. Consequently, secrets may remain in `memory/hook-audit.log` after command e ...[truncated 1253 chars]- Remediation
View remediation