T09 · Insecure Skill Coding Practices
Error
- Location
verify.sh:204- Finding
Environment-Controlled Configuration Path Enables Python Code Injection
- Content
View full analysis
/dev/null; then SECRET=$(python3 -c " import sys try: import yaml with open('$CONFIG_FILE', 'r') as f: config = yaml.safe_load(f) secret = config.get('security', {}).get('otp', {}).get('secret', '') print(secret if secret else '') except Exception: pass " 2>/dev/null) fi fi YUBIKEY_CLIENT_ID="${YUBIKEY_CLIENT_ID:-}" YUBIKEY_SECRET_KEY="${YUBIKEY_SECRET_KEY:-}" if [ -z "$YUBIKEY_CLIENT_ID" ] && [ -f "$CONFIG_FILE" ]; then if command -v python3 &>/dev/null; then YUBIKEY_CLIENT_ID=$(python3 -c " import sys try: import yaml with open('$CONFIG_FILE', 'r') as f: config = yaml.safe_load(f) client_id = config.get('security', {}).get('yubikey', {}).get('clientId', '') print(client_id if client_id else '') except Exception: pass " 2>/dev/null) fi fi if [ -z "$YUBIKEY_SECRET_KEY" ] && [ -f "$CONFIG_FILE" ]; then if command -v python3 &>/dev/null; then YUBIKEY_SECRET_KEY=$(python3 -c " import sys try: import yaml with open('$CONFIG_FILE', 'r') as f: config = yaml.safe_load(f) secret_key = config.get('security', {}).get('yubikey', {}).get('secretKey', '') print(secret_key if secret_key else '') except Exception: pass " 2>/dev/null) fi fi ``` ### Technical Analysis `CONFIG_FILE` is derived from the environment-controlled `CONFIG_FILE` or `OPENCLAW_CONFIG` variable. Its value is interpolated directly into source code supplied to `python3 -c`. Shell quoting does not protect the resulting Python string. A path containing a single quote and valid Python syntax can terminate the argument to `open()`, inject addi ...[truncated 1405 chars]- Remediation
View remediation