T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:14
- Finding
- Shell Command Injection Through User-Controlled Task Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 14–16; related command templates at lines 27–29 and 38–41 **Vulnerability Type**: Shell command injection caused by unsafe interpolation of user-controlled arguments **Risk Level**: High ### Vulnerable Code ```markdown ### Start a Task ```bash ~/.openclaw/scripts/claude-tmux.sh start "Your task description" [task-name] ``` ``` Related command templates also accept task identifiers: ```bash ~/.openclaw/scripts/claude-tmux.sh status <task-id> ``` ```bash ~/.openclaw/scripts/claude-tmux.sh stop <task-id> ~/.openclaw/scripts/claude-tmux.sh stop-all ``` The documented workflow establishes that the task description originates from the user: ```markdown 1. User says "use Claude Code xxx" → Optimize prompt → Show for approval 2. User confirms → Start background task → Return immediately ``` ### Technical Analysis The Skill directs an agent with the `Bash` tool to place user-supplied task descriptions and identifiers into shell command templates. It does not require strict input validation, shell escaping, or execution through an argument-safe process API. Placing the task description inside double quotes is insufficient protection. Bash still evaluates command substitutions such as `$(command)` and backtick expressions inside double-quoted strings. The task-name and task-ID placeholders are shown without quoting, which additionally permits whitespace splitting, redirection, pipelines, command separators, and other shell metacharacters if the agent performs direct textual substitution. For example, a task description containing: ```text Review the project $(touch /tmp/claude-runner-injected) ``` could produce: ```bash ~/.openclaw/scripts/claude-tmux.sh start "Review the project $(touch /tmp/claude-runner-injected)" audit ``` Bash would execute `touch /tmp/claude-runner-injected` before invoking the runner script. Exploitability depends on the agent constructing and executing these tem ...[truncated 1872 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct shell command strings by concatenating or interpolating user-controlled values. 2. Invoke the runner through a process API that accepts an executable and an argument array, with shell interpretation disabled. Conceptually: ```text executable: /home/user/.openclaw/scripts/claude-tmux.sh arguments: ["start", userTaskDescription, validatedTaskName] shell: false ``` 3. Validate task names and task IDs against a strict allowlist before execution. For example: ```regex ^[A-Za-z0-9_-]{1,64}$ ``` 4. Treat task descriptions as opaque data. Do not attempt to make them safe using quoting alone. 5. If Bash is unavoidable, pass user data through positional parameters rather than embedding it into shell source: ```bash bash -c 'exec "$1" start "$2" "$3"' -- \ "$HOME/.openclaw/scripts/claude-tmux.sh" \ "$TASK_DESCRIPTION" \ "$VALIDATED_TASK_NAME" ``` 6. Update the Skill instructions to explicitly prohibit raw interpolation into Bash commands and provide only argument-safe invocation examples. 7. Add tests covering command substitutions, backticks, semicolons, pipes, redirects, newlines, whitespace, wildcard characters, and leading hyphens. 8. Where supported by the runner, use `--` before user-controlled positional arguments to prevent values beginning with a hyphen from being parsed as options. 9. Audit the separately referenced `~/.openclaw/scripts/claude-tmux.sh` for unsafe `eval`, unquoted expansions, insecure temporary files, path traversal, and insufficient task-ID validation. ]]>