T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:19
- Finding
- Command Injection Through Unquoted Inbound Audio File Paths## Vulnerability Details **File Location**: `SKILL.md`, lines 19–24 **Vulnerability Type**: OS command injection through unsafe path interpolation **Risk Level**: High ```text /usr/bin/ffmpeg -i {input_file} -ar 16000 -ac 1 -c:a pcm_s16le {input_file}.wav Hinweis: Die Zieldatei heißt input_file.wav (Beispiel: /.../aufnahme.ogg → /.../aufnahme.wav) 2) Transkription - Transkribiere die WAV-Datei: /home/sirko/.openclaw/workspace/whisper.cpp/build/bin/whisper-cli -l DE -np -m /home/sirko/.openclaw/workspace/whisper.cpp/models/ggml-small.bin -f {input_wav_file} ``` ### Technical Analysis The skill instructs the agent to insert an inbound, potentially attacker-influenced file path directly into command lines. Neither `{input_file}` nor `{input_wav_file}` is quoted, validated, or passed through an argument-safe execution mechanism. If these command templates are executed through a shell, shell metacharacters in a crafted filename—such as command separators, substitutions, redirections, or whitespace—can alter the intended command structure. Merely quoting a path would reduce some risks but would not be as robust as invoking the executables without a shell and supplying each argument separately. The vulnerability affects both the FFmpeg conversion command and the Whisper transcription command. ### Attack Path 1. An attacker causes an audio file with a shell-significant filename to be placed in the monitored inbound media directory. 2. The skill receives that attacker-controlled path as `{input_file}`. 3. The agent substitutes the path into the documented FFmpeg command without validation or argument-safe handling. 4. If the command is passed to a shell, the shell interprets metacharacters in the filename as command syntax rather than as literal filename characters. 5. The injected command executes under the identity and privileges of the agent process. 6. The same injection condition can occur when the generated WAV pa ...[truncated 668 chars]
- Remediation
- ## Remediation Suggestions 1. Do not construct shell command strings from inbound file paths. Invoke FFmpeg and Whisper using an API that accepts an argument array and disables shell interpretation. 2. Canonicalize the input path and verify that it remains inside the approved inbound media directory. 3. Require the input to be a regular file and reject symbolic links or other special file types where appropriate. 4. Apply an explicit filename and extension policy. Reject control characters, shell metacharacters, unexpected whitespace, and unsupported media extensions. 5. Generate the output WAV path independently using a trusted temporary directory and a random filename rather than deriving a shell command argument directly from the untrusted input name. 6. Prevent option injection by using argument arrays and an end-of-options marker where supported. 7. Run media processing under a dedicated, least-privileged account with restricted filesystem and network access. 8. Add tests covering filenames containing spaces, quotes, semicolons, command substitutions, leading hyphens, newlines, and path traversal sequences.