T09 · Insecure Skill Coding Practices
- Location
SKILL.md:177- Finding
Shell Command Injection Through Unvalidated Topic Substitution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 177-187
Vulnerability Type: Command injection through unsafe textual substitution
Risk Level: HighComplete Code Snippet
bash cd /home/Vincent/.openclaw/workspace/ OUTPUT_DIR="/home/Vincent/.openclaw/workspace/tech-insight/business-strategy-analysis/{主题}" mkdir -p "$OUTPUT_DIR" mkdir -p "$OUTPUT_DIR/data" if [ ! -d "$OUTPUT_DIR" ]; then echo "Error: Failed to create output directory" exit 1 fiTechnical Analysis
The Skill instructs the agent to place a user-controlled topic directly into shell source code. No validation, canonicalization, or safe argument-passing mechanism is defined.
Double quotes do not make text safe when untrusted content is inserted into the command before shell parsing. Shell constructs such as command substitution remain active inside double-quoted strings. A topic containing
$(...)could therefore execute a command whileOUTPUT_DIRis being assigned. A topic containing quote characters could also terminate the quoted value and introduce additional shell syntax.The topic is subsequently used as a filesystem path. Even if shell metacharacters are rejected, path traversal components such as
../could cause generated reports and data files to be written outside the intended analysis directory.The vulnerability is in the Skill's execution instructions rather than a conventional application function, but an agent following those instructions can turn untrusted conversational input into executable shell code.
Attack Path
- An attacker supplies a business-analysis topic containing shell syntax, for example
$(touch /tmp/skill-topic-injection). - The agent substitutes that topic text into the documented
OUTPUT_DIR=".../{topic}"command. - The generated shell command is executed as instructed by the Skill.
- During assignment, the shell evaluates the command substitution and crea ...[truncated 828 chars]
- An attacker supplies a business-analysis topic containing shell syntax, for example
- Remediation
View remediation
Remediation Suggestions
- Never generate shell source by directly replacing a placeholder with conversational input.
- Pass the topic as data through an environment variable or positional argument rather than embedding it into a command.
- Convert the topic to a restricted slug, for example by allowing only ASCII letters, digits, underscores, and hyphens.
- Reject empty values, absolute paths,
.and..components, path separators, control characters, shell metacharacters, and command-substitution syntax. - Resolve and canonicalize the destination path, then verify that it remains beneath the intended output root before creating or writing files.
- Derive the workspace root from an explicitly configured trusted value rather than hardcoding another user's home directory.
- Prefer a filesystem API that accepts paths as structured arguments instead of invoking a shell.
- If shell use is unavoidable, assign untrusted input through a positional parameter and validate it before use:
bash set -euo pipefail topic="$1" case "$topic" in ''|*[!A-Za-z0-9_-]*) printf '%s\n' "Invalid topic identifier" >&2 exit 1 ;; esac output_root="${OPENCLAW_WORKSPACE:?}/tech-insight/business-strategy-analysis" output_dir="$output_root/$topic" mkdir -p -- "$output_dir/data"