T09 · Insecure Skill Coding Practices
Warning
- Location
- SKILL.md:22
- Finding
- Execution of Unreviewable External Maintenance Script## Vulnerability Details **File Location**: `SKILL.md`, lines 22-25 **Vulnerability Type**: Execution of code outside the reviewed skill package **Risk Level**: Medium **Complete Code Snippet**: ```markdown ### Run Full Maintenance ```bash python3 /root/.openclaw/workspace/scripts/nightly_optimizer.py ``` ``` ### Technical Analysis The skill instructs users or agents to execute an absolute-path Python script that is not included in the audited project. Because `/root/.openclaw/workspace/scripts/nightly_optimizer.py` is outside this package, its implementation, integrity, ownership, cleanup boundaries, and memory-handling behavior cannot be verified during review. The documented features indicate that this external script may delete temporary files, modify memory data, and write decision logs. If another process or user can create or modify the referenced file, following the documented command will execute that party's code with the permissions of the invoking process. No integrity verification, trusted ownership check, path validation, or execution isolation is documented. The `/root/` path does not by itself prove privilege escalation or that execution occurs as root. The maximum effective privileges are those already held by the user or agent invoking the command. ### Attack Path 1. An attacker or compromised local component obtains the ability to create or modify `/root/.openclaw/workspace/scripts/nightly_optimizer.py`. 2. The attacker inserts arbitrary Python instructions into that script. 3. A user or agent follows the maintenance instructions in `SKILL.md`. 4. `python3` executes the externally controlled script without an integrity or ownership check. 5. The payload performs actions available to the invoking account, potentially including file deletion, memory modification, data access, or further command execution. This exploitation path depends on the attacker first obtaining write access to the reference ...[truncated 743 chars]
- Remediation
- ## Remediation Suggestions 1. Include `nightly_optimizer.py` inside the skill package so its exact implementation can be reviewed and versioned with `SKILL.md`. 2. Reference the bundled script through a package-relative path resolved from a trusted base directory rather than a mutable absolute workspace path. 3. Verify the script's ownership, permissions, canonical path, and cryptographic digest before execution when external placement is unavoidable. 4. Restrict write access to the script and all parent directories; do not execute it from a location writable by less-trusted users or processes. 5. Run maintenance under a dedicated least-privileged account and limit filesystem access to explicitly approved directories. 6. Validate cleanup targets using canonical paths and an allowlist. Reject root directories, symlinks escaping approved directories, empty paths, and traversal sequences. 7. Provide a dry-run mode, explicit deletion limits, structured audit logs, and recovery or backup controls before modifying files or persistent memory. 8. Require explicit authorization for destructive operations and memory mutation rather than relying solely on age or disk-usage thresholds.