T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:31- Finding
Shell Command Injection Through Improper Escaping of User-Controlled Input
- Content
View full analysis
","source":"openclaw"}' ``` Remember to JSON-escape the user text (escape `"`, `\`, newlines). ``` ### Technical Analysis The skill requires the agent to insert user-controlled text directly into a Bash command. The JSON request body is enclosed in single quotes, but the escaping instructions only address JSON metacharacters: double quotes, backslashes, and newlines. JSON escaping does not protect a shell single-quoted argument. If the supplied message contains an apostrophe, it can terminate the shell string. Subsequent shell metacharacters such as semicolons, command substitutions, redirections, or pipelines may then be interpreted by Bash. The risk is increased by instructions elsewhere in the skill requiring the agent to preserve and forward the user's original wording. Consequently, malicious shell syntax contained in a store-related request could reach the vulnerable command construction without normalization. For example, interpolating a message conceptually shaped like: ```text status'; id; # ``` would produce shell source shaped like: ```bash curl -fsS -X POST "http://127.0.0.1:8000/creem-agent/chat" \ -H 'Content-Type: application/json' \ -d '{"message":"status'; id; #","source":"openclaw"}' ``` The apostrophe closes the `-d` argument, the semicolon begins another command, and the comment marker suppresses the remaining malformed command text. The exact exploitability depends on whether the host agent executes the documented command through a shell, but the skill explicitly directs it to use Bash. ### Attack Path 1. ...[truncated 1498 chars]- Remediation
View remediation