T09 · Insecure Skill Coding Practices
- Location
SKILL.md:15- Finding
Predictable Temporary File Enables Symlink-Based File Overwrite
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 15
Vulnerability Type: Unsafe predictable temporary file
Risk Level: Mediumbash jq '.plugins.allow += ["memory-core"]' ~/.openclaw/openclaw.json > /tmp/oc.json && mv /tmp/oc.json ~/.openclaw/openclaw.jsonTechnical Analysis
The documented configuration update writes sensitive configuration output to the fixed, globally predictable path
/tmp/oc.json. On systems where/tmpis shared, another local user or process can create this path before the command runs, including as a symbolic link.Shell output redirection follows symbolic links. Consequently, if
/tmp/oc.jsonpoints to another file writable by the user executing the command, thejqoutput can overwrite that file. The subsequentmvcan also replace~/.openclaw/openclaw.jsonwith attacker-influenced content or otherwise corrupt the configuration. The procedure does not use exclusive temporary-file creation, restrictive permissions, ownership checks, or validation before replacement.Attack Path
- A local attacker determines that the victim may run the documented troubleshooting command.
- The attacker pre-creates
/tmp/oc.jsonas a symbolic link to a file writable by the victim, or otherwise controls the predictable path. - The victim runs the command from
SKILL.md. - Shell redirection follows the symbolic link and writes the generated JSON to the attacker-selected destination.
- If execution continues,
mvmay replace the OpenClaw configuration using attacker-influenced or malformed temporary-file state. - The altered file or configuration can cause data corruption, service disruption, or unintended plugin configuration when OpenClaw next starts.
Exploitation requires local access or control over another process capable of manipulating the shared temporary directory. The attack does not independently grant root privileges; its write capability is limited to files ...[truncated 874 chars]
- Remediation
View remediation
Remediation Suggestions
Replace the predictable shared temporary path with a uniquely and securely created file. Create it in the destination directory so the final rename remains atomic, apply restrictive permissions, validate the generated JSON, and remove the temporary file on failure.
bash config="$HOME/.openclaw/openclaw.json" tmp="$(mktemp "$HOME/.openclaw/openclaw.json.XXXXXX")" || exit 1 trap 'rm -f "$tmp"' EXIT chmod 600 "$tmp" || exit 1 jq '.plugins.allow = ((.plugins.allow // []) + ["memory-core"] | unique)' \ "$config" > "$tmp" || exit 1 jq empty "$tmp" || exit 1 mv -- "$tmp" "$config" || exit 1 trap - EXITAdditional hardening should include:
- Backing up the original configuration before replacement.
- Verifying the source configuration is a regular file owned by the expected user.
- Preserving appropriate ownership and permissions.
- Avoiding fixed filenames in shared temporary directories.
- Restarting the gateway only after the replacement and validation succeed.