T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:15
- Finding
- Predictable Temporary File Enables Symlink-Based File Overwrite## Vulnerability Details **File Location**: `SKILL.md`, line 15 **Vulnerability Type**: Unsafe predictable temporary file **Risk Level**: Medium ```bash jq '.plugins.allow += ["memory-core"]' ~/.openclaw/openclaw.json > /tmp/oc.json && mv /tmp/oc.json ~/.openclaw/openclaw.json ``` ### Technical Analysis The documented configuration update writes sensitive configuration output to the fixed, globally predictable path `/tmp/oc.json`. On systems where `/tmp` is shared, another local user or process can create this path before the command runs, including as a symbolic link. Shell output redirection follows symbolic links. Consequently, if `/tmp/oc.json` points to another file writable by the user executing the command, the `jq` output can overwrite that file. The subsequent `mv` can also replace `~/.openclaw/openclaw.json` with attacker-influenced content or otherwise corrupt the configuration. The procedure does not use exclusive temporary-file creation, restrictive permissions, ownership checks, or validation before replacement. ### Attack Path 1. A local attacker determines that the victim may run the documented troubleshooting command. 2. The attacker pre-creates `/tmp/oc.json` as a symbolic link to a file writable by the victim, or otherwise controls the predictable path. 3. The victim runs the command from `SKILL.md`. 4. Shell redirection follows the symbolic link and writes the generated JSON to the attacker-selected destination. 5. If execution continues, `mv` may replace the OpenClaw configuration using attacker-influenced or malformed temporary-file state. 6. The altered file or configuration can cause data corruption, service disruption, or unintended plugin configuration when OpenClaw next starts. Exploitation requires local access or control over another process capable of manipulating the shared temporary directory. The attack does not independently grant root privileges; its write capability is limited to files ...[truncated 874 chars]
- Remediation
- ## Remediation Suggestions Replace the predictable shared temporary path with a uniquely and securely created file. Create it in the destination directory so the final rename remains atomic, apply restrictive permissions, validate the generated JSON, and remove the temporary file on failure. ```bash config="$HOME/.openclaw/openclaw.json" tmp="$(mktemp "$HOME/.openclaw/openclaw.json.XXXXXX")" || exit 1 trap 'rm -f "$tmp"' EXIT chmod 600 "$tmp" || exit 1 jq '.plugins.allow = ((.plugins.allow // []) + ["memory-core"] | unique)' \ "$config" > "$tmp" || exit 1 jq empty "$tmp" || exit 1 mv -- "$tmp" "$config" || exit 1 trap - EXIT ``` Additional hardening should include: - Backing up the original configuration before replacement. - Verifying the source configuration is a regular file owned by the expected user. - Preserving appropriate ownership and permissions. - Avoiding fixed filenames in shared temporary directories. - Restarting the gateway only after the replacement and validation succeed.