T09 · Insecure Skill Coding Practices
Error
- Location
grago.sh:101- Finding
Agent-Controlled Arbitrary Shell Command Execution
- Content
View full analysis
/dev/null) || data="[transform failed]" fi ``` ```bash local data data=$(eval "$fetch_cmd") || err "Fetch command failed" if [[ -n "$transform_cmd" ]]; then data=$(echo "$data" | eval "$transform_cmd") || err "Transform failed" fi ``` ### Technical Analysis The `fetch`, `research`, and `pipe` commands pass command-line arguments or YAML-derived transformation values directly to the shell through `eval`. No command allowlist, argument separation, metacharacter validation, sandbox, user confirmation, or privilege reduction is applied. Because `eval` reparses its argument as shell syntax, an attacker can use command substitution, redirection, pipelines, separators, or subshells to execute commands unrelated to data fetching. The AI-facing documentation explicitly encourages an OpenClaw agent to populate these parameters, meaning prompt injection affecting the agent can reach the execution sink. The security documentation acknowledges this behavior, but disclosure does not constrain or mitigate the execution capability. General-purpose shell access is substantially broader than the minimum privilege required to fetch URLs and perform fixed data transformations. ### Attack Path 1. An attacker places malicious instructions in content processed by the OpenClaw agent or otherwise influences a research request. 2. The compromised agent constructs a Grago invocation containing attacker-controlled shell syntax, for example in `--fetch` or `--transform`. 3. `cmd_pipe`, `cmd_fetch`, or `cmd_research` assigns that value to a ...[truncated 969 chars]- Remediation
View remediation