T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:97- Finding
Shell Command Injection Through Unvalidated Publishing Parameters
- Content
View full analysis
\ --slug \ --name "" \ --version \ --changelog "" \ --tags latest ``` ### Technical Analysis The publishing workflow directs the agent to interpolate dynamic values into a shell command. These values include user-provided data and metadata read from the skill being published: - `` - `` - `` - `` - `` The folder path, slug, and version are unquoted. Consequently, shell separators, substitutions, redirections, and additional arguments in these values may be interpreted by the shell. Although name and changelog are enclosed in double quotes, double quotes do not suppress shell command substitution. A value containing syntax such as `$(command)` or backticks can therefore execute a command when the generated shell command is evaluated. No validation, canonicalization, safe argument-array invocation, or shell-escaping procedure is specified before execution. ### Attack Path 1. An attacker supplies a malicious changelog, version, slug, folder name, or `name` field in the target skill's `SKILL.md`. 2. For example, the attacker provides a changelog containing `$(malicious-command)`. 3. The agent follows the documented workflow and inserts that value into the `clawhub publish` shell command. 4. The shell evaluates the command substitution even though the changelog is surrounded by double quotes. 5. The injected command executes with the same operating-system identity and permissions as the agent or CLI process. 6. The legitimate publication command may then continue, fail, or be manipulated to conceal the injected execution. ### Impact Assessment Successful exploitation permits arbitrary local command execution with the privileges of the account running the agent. Dep ...[truncated 550 chars]- Remediation
View remediation