T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:272
- Finding
- PowerShell Command Injection Through a User-Controlled Output Path<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:272`, `SKILL.md:288-289` **Vulnerability Type**: OS command injection **Risk Level**: High ### Vulnerable Code ```bash output_file="${save_path:-/tmp/doubao_tts_$(date +%s).mp3}" ``` ```bash elif command -v powershell &> /dev/null; then powershell -c "(New-Object Media.SoundPlayer '$output_file').PlaySync()" ``` ### Technical Analysis The output path can originate from the user-controlled `save_path` value. Although the shell quotes `"$output_file"` when expanding it, its value is subsequently embedded inside a dynamically constructed PowerShell program. The PowerShell command encloses the path in single quotes without escaping embedded single quotes or other PowerShell syntax. A crafted path can therefore terminate the string literal and append arbitrary PowerShell statements. Shell quoting does not protect values after they are inserted into source code interpreted by another command processor. This is a second-order command-injection vulnerability. ### Attack Path 1. An attacker supplies a TTS request with a malicious save path. 2. The path is assigned to `save_path` and then to `output_file`. 3. The Skill successfully requests or processes TTS audio. 4. On a system where PowerShell is selected as the available player, `output_file` is interpolated into the `powershell -c` source string. 5. An embedded single quote terminates the intended path literal. 6. PowerShell parses and executes the attacker's appended statements with the privileges of the Agent process. For example, a path shaped like `'; <attacker-command>; #'` can alter the resulting PowerShell program rather than being treated solely as a filename. ### Impact Assessment Successful exploitation permits arbitrary PowerShell command execution with the same operating-system privileges as the OpenClaw or Agent process. Depending on those privileges, an attacker could read or modify user files, access locally available cred ...[truncated 248 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Do not interpolate filenames into dynamically evaluated PowerShell source. - Pass the path as a positional argument to a fixed PowerShell script and access it through PowerShell's argument array. - Prefer an invocation pattern that keeps code and data separate. - Validate that the requested destination is within an explicitly permitted directory. - Canonicalize paths before use and reject unexpected characters, alternate data streams, and unsafe path forms. - Use native platform APIs or a player command that accepts the filename as a normal argument without evaluating it as source code. - Add regression tests using paths containing single quotes, semicolons, newlines, and PowerShell metacharacters. ]]>