T09 · Insecure Skill Coding Practices
Error
- Location
- create_invoice.sh:6
- Finding
- Unvalidated Input Evaluated as a Bash Arithmetic Expression<![CDATA[ ## Vulnerability Details **File Location**: `create_invoice.sh`, lines 6-14 **Vulnerability Type**: Shell command injection through unsafe arithmetic evaluation **Risk Level**: High ### Vulnerable Code ```bash # Check amount argument if [ -z "$1" ]; then echo "Usage: $0 <amount_sats>" echo "Example: $0 1000" exit 1 fi # Convert sats to msats (API expects msats) AMOUNT_SATS="$1" AMOUNT_MSATS=$((AMOUNT_SATS * 1000)) ``` ### Technical Analysis The script only verifies that the first argument is nonempty. It does not ensure that the value is a decimal integer before using it in Bash arithmetic expansion. Bash arithmetic expressions can recursively interpret variable values as arithmetic syntax. Crafted values may introduce variable references, array subscripts, or command substitutions in arithmetic contexts. Consequently, treating untrusted input as an arithmetic expression can result in unintended command execution rather than a simple numeric conversion. The vulnerable expression executes with the privileges and environment of the user running the Skill. ### Attack Path 1. An attacker supplies or persuades the user or agent to supply a specially crafted invoice amount. 2. The value is copied unchanged into `AMOUNT_SATS`. 3. The script evaluates `AMOUNT_SATS` inside `$((...))`. 4. Bash interprets the crafted value as arithmetic syntax and may evaluate embedded expansion constructs. 5. Attacker-controlled commands execute under the account that invoked the script. ### Impact Assessment Successful exploitation may provide arbitrary command execution with the privileges of the current Skill user. This could permit access to files readable by that account, including `~/.openclaw/openclaw.json` and its Routstr API key, modification of user-owned data, execution of network requests, or installation of user-level persistence. The issue does not directly grant root privileges unless the script is separately invoked through a privileged executio ...[truncated 16 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Validate the argument before any arithmetic operation and enforce a reasonable business limit: ```bash AMOUNT_SATS="${1:-}" if [[ ! "$AMOUNT_SATS" =~ ^[0-9]+$ ]]; then echo "Error: amount_sats must be a positive decimal integer." >&2 exit 1 fi if (( 10#$AMOUNT_SATS == 0 || 10#$AMOUNT_SATS > 100000000 )); then echo "Error: amount_sats is outside the permitted range." >&2 exit 1 fi AMOUNT_MSATS=$((10#$AMOUNT_SATS * 1000)) ``` The `10#` prefix forces base-10 interpretation after validation. The maximum value should be selected according to the service's documented limits and should also prevent integer overflow. Add tests covering empty, negative, hexadecimal, oversized, malformed, and expression-like inputs. Consider enabling strict shell behavior with `set -euo pipefail`, while explicitly handling expected command failures. ]]>