T09 · Insecure Skill Coding Practices
Error
- Location
- grago.sh:101
- Finding
- Agent-Controlled Arbitrary Shell Command Execution<![CDATA[ ## Vulnerability Details **File Location**: `grago.sh:101`, `grago.sh:153`, `grago.sh:184`, and `grago.sh:187` **Vulnerability Type**: Command injection through unrestricted `eval` **Risk Level**: Critical ### Vulnerable Code ```bash if [[ -n "$transform" ]]; then data=$(echo "$data" | eval "$transform") || err "Transform failed: $transform" fi ``` ```bash if [[ -n "$transform" ]]; then data=$(echo "$data" | eval "$transform" 2>/dev/null) || data="[transform failed]" fi ``` ```bash local data data=$(eval "$fetch_cmd") || err "Fetch command failed" if [[ -n "$transform_cmd" ]]; then data=$(echo "$data" | eval "$transform_cmd") || err "Transform failed" fi ``` ### Technical Analysis The `fetch`, `research`, and `pipe` commands pass command-line arguments or YAML-derived transformation values directly to the shell through `eval`. No command allowlist, argument separation, metacharacter validation, sandbox, user confirmation, or privilege reduction is applied. Because `eval` reparses its argument as shell syntax, an attacker can use command substitution, redirection, pipelines, separators, or subshells to execute commands unrelated to data fetching. The AI-facing documentation explicitly encourages an OpenClaw agent to populate these parameters, meaning prompt injection affecting the agent can reach the execution sink. The security documentation acknowledges this behavior, but disclosure does not constrain or mitigate the execution capability. General-purpose shell access is substantially broader than the minimum privilege required to fetch URLs and perform fixed data transformations. ### Attack Path 1. An attacker places malicious instructions in content processed by the OpenClaw agent or otherwise influences a research request. 2. The compromised agent constructs a Grago invocation containing attacker-controlled shell syntax, for example in `--fetch` or `--transform`. 3. `cmd_pipe`, `cmd_fetch`, or `cmd_research` assigns that value to a ...[truncated 969 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove every use of `eval`. 2. Replace free-form commands with a strict operation schema, such as predefined `curl`, `jq`, `grep`, and `tail` actions with separately represented arguments. 3. Execute commands using Bash arrays rather than reconstructed command strings: ```bash command_args=(jq "$filter") printf '%s' "$data" | "${command_args[@]}" ``` 4. Allowlist supported executables and options, and reject shell metacharacters, redirections, command substitutions, and environment assignments. 5. Require explicit user approval before any operation that reads local files, writes files, or invokes external processes. 6. Run transformations in a sandbox or isolated container with a read-only filesystem, restricted network access, resource limits, and a dedicated unprivileged account. 7. Treat agent-generated command arguments as untrusted even in single-user environments, because external content can prompt-inject the agent. 8. Add tests demonstrating that payloads containing separators, substitutions, pipelines, and redirections cannot escape the intended operation. ]]>