T09 · Insecure Skill Coding Practices
Error
- Location
tools/create-agent.sh:49- Finding
Unvalidated Agent Names and Workspace Paths Allow Directory Escape and File Overwrite
- Content
View full analysis
"${AGENT_CONFIG_DIR}/IDENTITY.md" << EOF ``` ```bash cat > "${AGENT_CONFIG_DIR}/SOUL.md" << EOF ``` ```bash cat > "${AGENT_CONFIG_DIR}/USER.md" << EOF ``` ```bash cat > "${AGENT_CONFIG_DIR}/AGENTS.md" << EOF ``` ```bash cat > "${AGENT_CONFIG_DIR}/HEARTBEAT.md" << EOF ``` ```bash touch "${AGENT_CONFIG_DIR}/MEMORY.md" ``` ```bash cat > "${AGENT_CONFIG_DIR}/QUICKSTART.md" << EOF ``` ```bash cat > "${WORKSPACE_PATH}/README.md" << EOF ``` ### Technical Analysis The script does not enforce the documented kebab-case format for `AGENT_NAME`. In particular, it does not reject path separators, `.` components, or `..` traversal components. The value is directly appended to: ```text $HOME/.openclaw/agents/ ``` Consequently, a name containing sufficient `../` components can resolve outside the intended agents directory. The custom ...[truncated 2619 chars]- Remediation
View remediation
&2 exit 1 fi ``` 2. Explicitly reject: - `/` and backslash path separators. - `.` and `..` path components. - Control characters and newlines. - Empty or excessively long names. 3. Canonicalize both the approved root and destination, then verify containment: ```bash AGENTS_ROOT=$(realpath -m "${HOME}/.openclaw/agents") AGENT_CONFIG_DIR=$(realpath -m "${AGENTS_ROOT}/${AGENT_NAME}") case "${AGENT_CONFIG_DIR}/" in "${AGENTS_ROOT}/"*) ;; *) echo "Error: agent directory escapes the approved root" >&2 exit 1 ;; esac ``` 4. Apply equivalent containment validation to workspace paths. If arbitrary custom workspaces are required, require explicit confirmation and clearly warn before operating outside the default workspace root. 5. Reject symbolic-link destinations: ```bash [[ -L "$AGENT_CONFIG_DIR" ]] && exit 1 [[ -L "${AGENT_CONFIG_DIR}/IDENTITY.md" ]] && exit 1 ``` 6. Refuse to overwrite an existing agent by default. Add an explicit, clearly documented `--force` option if replacement is necessary. 7. Create files with no-clobber semantics or write to secure temporary files followed by an atomic rename after validation. 8. Set restrictive permissions for generated configuration: ```bash umask 077 ``` 9. Remove documentation suggesting that agent creation generally requires administrator privileges. The tool should operate under the least-privileged OpenClaw account. ]]>