T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/feishu-sheet.sh:223
- Finding
- Arbitrary Python Code Execution Through Unsafely Interpolated Image Path<![CDATA[ ## Vulnerability Details **File Location**: `scripts/feishu-sheet.sh`, lines 223–226 **Vulnerability Type**: Python code injection **Risk Level**: High ### Vulnerable Code ```bash image_array=$(python3 -c " with open('$image_path','rb') as f: print(list(f.read())) ") ``` ### Technical Analysis The user-controlled `image_path` argument is directly interpolated into source code passed to `python3 -c`. Shell quoting does not make this safe because the value is inserted inside a Python single-quoted string. A path containing a single quote followed by valid Python syntax can terminate the intended string and inject additional Python statements. The injected code runs with the same operating-system identity and permissions as the Skill process. This also contradicts the security statement in `SKILL.md` claiming that inline Python uses safe single-quoted strings. Single quotes alone do not prevent injection when untrusted values are concatenated into source code. ### Attack Path 1. An attacker influences the file path supplied to the `insert_image` action. 2. The attacker constructs a path containing a single quote and Python syntax that escapes the `open('$image_path', ...)` expression. 3. The shell expands `image_path` while constructing the `python3 -c` program. 4. Python parses and executes the injected statements. 5. The injected code can invoke system commands, read local files, or access credentials available to the Skill process. A vulnerable invocation has the following data flow: ```text insert_image argument -> image_path -> interpolation into python3 -c source -> arbitrary Python execution -> local process compromise ``` ### Impact Assessment Successful exploitation provides arbitrary code execution under the account running the Skill. The attacker may: - Read `~/.openclaw/openclaw.json` and recover configured credentials. - Read or modify other files accessible to the process. - Access the cached Feishu tenant token. - I ...[truncated 361 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions Never insert file paths or other untrusted values into generated Python source. Pass the path as a positional argument: ```bash image_array=$(python3 -c ' import sys with open(sys.argv[1], "rb") as f: print(list(f.read())) ' "$image_path") ``` Additionally: 1. Validate that the path refers to an allowed regular file. 2. Reject symbolic links if they are not required. 3. Apply file-size limits before reading the entire image into memory. 4. Validate the file's actual image type rather than relying on its name. 5. Pass all dynamic values to Python through `sys.argv`, standard input, or structured JSON. 6. Add regression tests using paths containing quotes, backslashes, newlines, and Python syntax. 7. Correct the security documentation so it reflects the implementation and does not claim unsafe interpolation is protected. ]]>