T09 · Insecure Skill Coding Practices
- Location
SKILL.md:39- Finding
Shell Command Injection Through Unsafe Shortlink Parameter Interpolation
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 39–43
Vulnerability Type: Shell command injection through unsafe interpolation of user-controlled values
Risk Level: HighVulnerable Code
bash curl -s -X POST \ -H "Content-Type: application/json" \ -H "X-API-Key: $URLMITRA_API_KEY" \ -d '{"url": "{url}", "alias": "{slug}"}' \ https://api.urlmitra.com/api/v1/linksTechnical Analysis
The documented command instructs the agent to replace
{url}and{slug}inside a single-quoted shell argument. These values may originate from user input, but the skill neither validates them nor safely serializes them as JSON.If the command is constructed through literal placeholder substitution, a value containing a single quote can terminate the shell-quoted argument. Subsequent shell metacharacters can then be interpreted as executable syntax rather than request data. JSON escaping alone is insufficient because shell quoting is processed before
curlreceives the argument.The weakness applies to both the destination URL and alias fields. Using HTTPS protects data in transit but does not prevent local command injection during command construction.
Attack Path
- An attacker asks the agent to shorten a URL or create an alias containing a single quote followed by shell syntax.
- The agent substitutes that value directly for
{url}or{slug}in the documented command. - The injected single quote closes the existing shell argument.
- The shell interprets the remaining metacharacters and attacker-controlled text as commands.
- The injected command executes with the same operating-system permissions and environment as the agent process.
A conceptual malicious value could follow this structure:
text ' ; attacker_controlled_command ; #Impact Assessment
Successful exploitation could execute arbitrary shell commands with the privileges of the OpenClaw agen ...[truncated 584 chars]
- Remediation
View remediation
Remediation Suggestions
Do not insert user-controlled values into shell source code. Store values in variables, construct JSON with
jq, and pass the resulting payload as a quoted argument:bash payload=$(jq -n \ --arg url "$url" \ --arg alias "$slug" \ '{url: $url, alias: $alias}') curl -sS --fail-with-body -X POST \ -H 'Content-Type: application/json' \ -H "X-API-Key: $URLMITRA_API_KEY" \ --data-binary "$payload" \ 'https://api.urlmitra.com/api/v1/links'Additional hardening should include:
- Validate destination URLs with a proper URL parser and permit only required schemes such as HTTPS.
- Restrict aliases to a strict allowlist, such as letters, digits, hyphens, and an explicitly defined maximum length.
- Never generate commands by replacing placeholders in a command string and then evaluating that string.
- Prefer direct process invocation with an argument array when supported, avoiding an intermediate shell.
- Run the agent with least privilege and scope the API key to only the URLMitra operations required by this skill.
- Avoid logging request headers or environment variables containing the API key.