T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:113
- Finding
- Shell Command Injection Through Attacker-Controlled Event Names<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 75 and lines 113-118 **Vulnerability Type**: OS command injection **Risk Level**: High ### Vulnerable Code At line 75: ```bash openclaw cron rm "lunar_<事件名>" ``` At lines 113-118: ```bash # 先删除旧任务 openclaw cron rm "lunar_<事件名>" # 创建新任务 openclaw cron add --name "lunar_<事件名>" --cron "<分> <时> <日> <月> *" --message "🔔 农历提醒：<事件名>将在<N>天后到来" --tz "Asia/Shanghai" ``` ### Technical Analysis The workflow instructs the agent to extract an event name from user input and interpolate it directly into shell commands. Although the interpolated values are enclosed in double quotes, double-quoted shell strings still evaluate command substitutions using `$(...)` or backticks. The instructions do not require validation, shell escaping, or execution through an argument-array API with shell interpretation disabled. The affected values appear in both the cron task name and message. Consequently, a malicious event name can alter shell behavior when the deletion or synchronization workflow executes the generated command. ### Attack Path 1. An attacker asks the agent to create a reminder with an event name containing shell command substitution, such as `$(touch /tmp/lunar-pwned)`. 2. The workflow accepts and stores the event name in `data/events.json` without defining any security validation. 3. The attacker requests reminder synchronization or deletion. 4. The agent substitutes the stored event name into an `openclaw cron rm` or `openclaw cron add` shell command. 5. The shell evaluates the command substitution before invoking `openclaw`. 6. The injected command runs with the operating-system permissions of the agent process. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the agent. The attacker could read or modify files accessible to that account, steal locally available credentials, disrupt application data, invoke other installed utilities, ...[truncated 217 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not construct shell command strings using user-controlled event names or messages. 2. Invoke `openclaw` through a process API that accepts an argument array and explicitly disables shell processing. For example, pass `cron`, `add`, `--name`, and each value as separate arguments. 3. Validate event names before storage and before use. Apply a conservative allowlist covering only necessary letters, numbers, spaces, and selected punctuation. 4. Reject command-substitution syntax, shell metacharacters, control characters, newlines, and null bytes. Validation should be defense in depth rather than the sole protection. 5. Generate an internal task identifier independently of the display name, such as a random UUID or a safely encoded identifier. Use that identifier for cron task names. 6. Treat reminder messages as data and pass them as a separate process argument rather than embedding them into a command string. 7. Revalidate existing records loaded from `data/events.json`, because previously stored values may already contain malicious content. 8. Add security tests covering event names containing `$()`, backticks, quotes, semicolons, newlines, option-like prefixes, and Unicode edge cases. ]]>