T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:207- Finding
Unquoted Workflow Parameters in Shell Command Templates
- Content
View full analysis
- Remediation
View remediation
&2 exit 1 fi ``` 2. Validate dates as strict ISO values and reject malformed or option-like input. Where practical, parse them with a trusted date library rather than relying only on a regular expression. 3. Quote every variable expansion: ```bash readonly SCRIPTS="$HOME/.openclaw/workspace/scripts/pipelines" OUT="$HOME/Desktop/close-${SLUG}-$(date +%Y%m)" python3 "$SCRIPTS/bank-reconciliation.py" \ --slug "$SLUG" \ --start "$MONTH_START" \ --end "$MONTH_END" \ --out "$OUT" ``` 4. Resolve and validate the output directory against an approved base directory. Reject traversal components, unexpected symbolic links, and destinations outside that base. 5. Never construct commands through `eval`, `sh -c`, or direct textual interpolation of user input. Prefer a subprocess API with an argument array when implementing orchestration programmatically. 6. Use fixed script paths from the trusted manifest, verify that each resolved script remains under the expected pipeline directory, and do not permit a user-controlled script name. 7. Add `--` before positional values where supported by the downstream parser. Also reject values beginning with `-` when they are identifiers rather than options. 8. Apply safe shell defaults such as `set -euo pipefail` where compatible, while explicitly collecting background-process statuses so parallel pipeline failures remain visible. ]]>