T09 · Insecure Skill Coding Practices
Error
- Location
- references/API_REFERENCE.md:13
- Finding
- Command Injection Through Unsafe Refresh Token Configuration<![CDATA[ ## Vulnerability Details **File Location**: `references/API_REFERENCE.md:13-16` **Vulnerability Type**: Shell command injection through unsafe interpolation of user-controlled credential data **Risk Level**: High ### Vulnerable Code ```bash 用户提供 token 后，写入配置： ```bash sed -i '' 's/^IFIND_REFRESH_TOKEN=.*/IFIND_REFRESH_TOKEN=用户提供的token/' ~/.openclaw/skills/ifind-api/.env ``` ``` The instructions direct the Agent to replace the placeholder with a refresh token supplied by the user and then execute the resulting shell command. ### Technical Analysis The user-provided refresh token is inserted into a single-quoted shell command without shell escaping or safe argument handling. If an Agent follows these instructions through direct string substitution, a malicious token containing a single quote can terminate the quoted `sed` expression. Subsequent characters may then be interpreted as shell syntax. Even when shell command execution is not achieved, `sed` replacement metacharacters such as `&`, backslashes, or the selected delimiter can alter or corrupt the resulting configuration value. Credential configuration is necessary for the Skill, but interpolating a credential into a shell command is not the minimum privilege or safest mechanism needed to perform that operation. ### Attack Path 1. The Skill determines that `IFIND_REFRESH_TOKEN` is missing. 2. It asks the user to provide a refresh token. 3. An attacker supplies a crafted value containing a quote followed by shell syntax. 4. The Agent substitutes that value for the documented placeholder. 5. The shell terminates the intended quoted `sed` expression and interprets the injected syntax. 6. The injected command executes with the same operating-system privileges as the Agent process. This path depends on the Agent following the documentation by performing direct textual interpolation, which is precisely the workflow prescribed by the reference. ### Impact Assessment Successful exploitation p ...[truncated 561 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the `sed` command and do not embed secret values in dynamically constructed shell commands. - Accept the token through protected standard input or a secret-management interface rather than as part of a command line. - Use a dedicated Python configuration routine that: 1. Reads the token as opaque data. 2. Updates only the exact `IFIND_REFRESH_TOKEN` key. 3. Creates the destination file if it does not exist. 4. Writes through a temporary owner-only file. 5. Atomically replaces the destination. - If shell usage is unavoidable, pass the token through an environment variable and process it with a tool that does not interpret it as executable syntax. Do not rely solely on ad hoc quote escaping. - Validate that the token matches the documented iFinD token format, while still treating validation as defense in depth rather than as a substitute for safe argument handling. - Avoid exposing the token in process arguments, logs, terminal history, or Agent responses. ]]>