T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:31
- Finding
- Arbitrary Shell Execution Through Sourced Environment File## Vulnerability Details **File Location**: `SKILL.md`, lines 31–38 **Vulnerability Type**: Unsafe configuration loading resulting in arbitrary shell execution **Risk Level**: High ### Vulnerable Code ```bash Before use, read the `.env` file to load the following environment variables: - `CLAWMATE_API_TOKEN`: Your Agent Token (obtained from the ClawMateSquare App) - `CLAWMATE_API_BASE`: API address, default `https://global.chaichaijizhang.xyz` # Read the .env file: source ~/.openclaw/skills/clawmatesquare/.env ``` ### Technical Analysis The Skill instructs the agent to load a `.env` file with the shell built-in `source`. Contrary to a data-only environment-file parser, `source` executes the entire file as shell code in the current shell context. An attacker who can modify or replace this file can insert command substitutions, shell functions, redirections, or arbitrary commands. Those commands execute with the same local filesystem, process, and network permissions available to the agent's terminal session. The declared functionality only requires reading two configuration values. Executing arbitrary shell syntax exceeds the minimum privilege necessary for that purpose. ### Attack Path 1. An attacker, compromised installer, or another local process modifies `~/.openclaw/skills/clawmatesquare/.env`. 2. Malicious shell statements are added alongside apparently legitimate environment assignments. 3. The agent follows `SKILL.md` and runs: ```bash source ~/.openclaw/skills/clawmatesquare/.env ``` 4. The shell executes the malicious statements in the agent's current context. 5. The payload can read accessible files and credentials, modify local data, or make outbound network requests. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the agent. The accessible scope may include: - The ClawMate API token and other environment variables - Files readable or writable by the agen ...[truncated 346 chars]
- Remediation
- ## Remediation Suggestions - Do not use `source`, `.`, `eval`, or equivalent shell execution to parse configuration. - Store configuration through the platform's protected secret-management mechanism where available. - If a file must be used, parse only an explicit allowlist of keys such as `CLAWMATE_API_TOKEN` and `CLAWMATE_API_BASE`. - Reject command substitutions, shell metacharacters, malformed lines, duplicate keys, and unexpected variables. - Require restrictive file permissions, such as owner-only read and write access. - Verify that the configuration file is a regular file owned by the expected user and is not a symbolic link. - Keep the token separate from mutable non-secret endpoint configuration.