T09 · Insecure Skill Coding Practices
Error
- Location
scripts/clawhub_skill_explorer.py:57- Finding
Shell Command Injection Through User-Controlled Skill Slugs
- Content
View full analysis
str: """Execute ClawHub CLI command""" try: result = os.popen(cmd).read().strip() return result except Exception as e: print(f"❌ Error executing command: {e}") return "" ``` User-controlled values are passed to this method at the following call sites: ```python output = self._execute_clawhub_cmd(f"clawhub inspect {slug}") ``` ```python output = self._execute_clawhub_cmd(f"clawhub star {slug}") ``` The `slug` values originate from unrestricted command-line arguments: ```python view_parser.add_argument("slug", help="技能slug") favorite_parser.add_argument("slug", help="技能slug") ``` ### Technical Analysis `os.popen()` executes its string argument through the operating-system shell. The `view` and `favorite` commands interpolate an unvalidated, user-controlled `slug` directly into that shell command. An attacker can include shell metacharacters such as semicolons, pipes, command substitutions, or redirections in the slug. The shell will interpret those characters rather than treating the entire value as one ClawHub argument. The existence check in `favorite_skill()` reduces straightforward exploitation through that command, but it is not a safe command-execution boundary. The `view` command passes the supplied slug directly to the vulnerable sink without first constraining it to the expected slug format. ### Attack Path 1. An attacker convinces a user or automation process to invoke the `view` command with a malicious slug. 2. `argparse` accepts the value as an unrestricted string. 3. `get_skill_details()` creates a command using `f"clawhub inspect {slug}"`. 4. `_execute_clawhub_cmd()` passes the resulting string to `os.popen() ...[truncated 829 chars]- Remediation
View remediation