T09 · Insecure Skill Coding Practices
Error
- Location
scripts/publish_skill.sh:109- Finding
Unrestricted registry override may redirect token authentication
- Content
View full analysis
/dev/null 2>&1; then echo "Using existing ClawHub login session." return 0 fi if [[ -z "${CLAWHUB_TOKEN:-}" ]]; then load_token_from_env_file "$ENV_FILE" || { echo "Error: CLAWHUB_TOKEN not found in env or $ENV_FILE" >&2 exit 1 } fi echo "Logging into ClawHub with token (hidden)..." clawhub login --token "$CLAWHUB_TOKEN" --no-browser >/dev/null clawhub whoami >/dev/null } ``` ```bash --registry) REGISTRY="${2:-}"; shift 2 ;; ``` ```bash if [[ -n "$REGISTRY" ]]; then export CLAWHUB_REGISTRY="$REGISTRY" fi ``` The batch synchronization script implements the same behavior: ```bash --registry) REGISTRY="${2:-}"; shift 2 ;; ``` ```bash if [[ -n "$REGISTRY" ]]; then export CLAWHUB_REGISTRY="$REGISTRY" fi ensure_authenticated ``` ### Technical Analysis Both scripts accept an arbitrary value through `--registry` and export it as `CLAWHUB_REGISTRY` before authentication. No URL parsing, HTTPS requirement, hostname allowlist, port restriction, or credential-in-URL rejection is applied. The documented use cases identify `clawhub.ai` and `www.clawhub.ai` as registry endpoints, but the implementation permits any caller-supplied destination. If the installed `clawhub` CLI uses `CLAWHUB_REGISTRY` for its login request, the subsequent `clawhub login --token` operation can disclose the token to an untrusted endpoint. Successful exploitation requires control over, or influence on, the script arguments. The final network behavior also depends on how the installed CLI interprets `CLAWHUB_REGISTRY`. ### Attack Path 1. A victim has a valid `CLAWHUB_TOKEN` in the environment or in the configured env file. ...[truncated 1034 chars]- Remediation
View remediation