T09 · Insecure Skill Coding Practices
- Location
SKILL.md:45- Finding
Potential Command Injection Through Unsanitized Skill Name
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 45-50
Vulnerability Type: Unsanitized user-controlled input in a CLI command
Risk Level: HighVulnerable Code Snippet:
markdown ## Step 1: Get Skill Information When user provides a skill name, fetch its metadata:Use clawhub CLI to inspect the skill:
- clawhub inspect {skill-name}
text Technical Analysis
The documented workflow places the user-provided
{skill-name}directly into a command without specifying validation, shell escaping, quoting, or a shell-free execution mechanism. If an implementing agent passes the resulting command to a shell, shell metacharacters in a malicious skill name could be interpreted as additional commands.The vulnerability depends on how the agent invokes the CLI. Using a process API with a fixed executable and an argument array would avoid shell interpretation, while constructing a command string and executing it through a shell would expose a command-injection path.
Attack Path
- An attacker asks the skill to inspect a crafted skill name containing shell-control characters and an additional command.
- The agent substitutes that value into
clawhub inspect {skill-name}. - The agent executes the constructed string through a shell without validation or escaping.
- The shell interprets the injected control characters and runs the attacker's additional command.
- The injected command executes with the operating-system privileges and environmental access of the agent process.
Impact Assessment
Successful exploitation could allow arbitrary local command execution under the account running the agent. The attacker could access files and credentials available to that account, alter workspace content, invoke network utilities, or execute additional programs. The vulnerability does not itself establish privilege escalation; its scope is limited to the privileges and isolation boundar ...[truncated 41 chars]
- Remediation
View remediation
Remediation Suggestions
- Validate skill names against the exact identifier syntax accepted by ClawHub. For example, use a strict allowlist such as
^[A-Za-z0-9._-]+$if that grammar is compatible with the service. - Reject values containing whitespace, shell metacharacters, command substitutions, redirection operators, or control characters.
- Invoke
clawhubthrough a process API using a fixed executable and argument array, such as arguments equivalent to["inspect", skillName]. - Do not invoke the command through a shell and do not concatenate user input into a command string.
- Apply a timeout and capture output through bounded buffers.
- Run the inspection process with minimal filesystem, network, and operating-system privileges.
- Add negative tests covering semicolons, pipes, redirection, newlines, command substitution, and platform-specific shell syntax.
- Validate skill names against the exact identifier syntax accepted by ClawHub. For example, use a strict allowlist such as