T09 · Insecure Skill Coding Practices
Error
- Location
download.md:53- Finding
Shell Command Injection Through an Unvalidated Download Directory
- Content
View full analysis
/tmp/ytdlp-{ts}-{rand}.log 2>&1" ``` ### Technical Analysis The `dir` value may originate from `preferences.download_dir`, prior tracking/history records, or a directory supplied by the user. Although the workflow verifies that the path identifies a directory, it does not define character validation, canonicalization, or safe argument passing. The download command inserts `{dir}` directly into a shell command without quoting it: ```bash cd {dir} && yt-dlp ... ``` Consequently, shell separators, command substitutions, redirections, or other metacharacters embedded in the value may be interpreted by the shell. The disk-space command uses double quotes, but command substitution can still be evaluated if the runtime constructs a shell command by textual interpolation. Checking whether a directory exists does not make its textual representation safe for shell evaluation. A valid directory name may itself contain shell-significant characters. ### Attack Path 1. An attacker or untrusted user supplies a crafted download directory through the preference workflow or the first-download directory prompt. 2. The value is accepted because the referenced directory exists. 3. The Skill interpolates the value into `command="cd {dir} && yt-dlp ..."` or the disk-space command. 4. The shell parses the injected metacharacters or command substitution. 5. The injected command executes with the same operating-system privileges as the OpenClaw Agent process. ### Impact Assessment Successful exploitation can provide arbitrary command execution under the Agent host account. Depending on that account's permissions, an attacker could: - Read or modify file ...[truncated 490 chars]- Remediation
View remediation