T09 · Insecure Skill Coding Practices
Error
- Location
references/test-cross-platform.sh:8- Finding
Cross-platform test script permanently deletes existing user memo data
- Content
View full analysis
/dev/null rm -f ~/.openclaw/workspace/completed-items.md 2>/dev/null ``` The files are deleted again during final cleanup: ```bash rm -f ~/.openclaw/workspace/pending-items.md 2>/dev/null rm -f ~/.openclaw/workspace/completed-items.md 2>/dev/null ``` The script then writes generic empty templates instead of restoring the user's original files: ```bash echo "Restoring original files..." cat > ~/.openclaw/workspace/pending-items.md << 'EOF' # 📝 Pending Items _Last updated: 2026-03-15 10:00 ## Pending items _No pending items_ ... EOF cat > ~/.openclaw/workspace/completed-items.md << 'EOF' # ✅ Completed Items _Created at: 2026-03-15 00:19_ ... _No completed items yet_ ... EOF ``` ### Technical Analysis The test script performs destructive operations directly against the normal OpenClaw workspace rather than an isolated test directory. It unconditionally removes the user's pending and completed memo files without confirmation, backup creation, or a recovery mechanism. Although the script claims to restore the original files, it only creates predefined empty templates. Existing tasks, completion history, timestamps, and any manually added content are therefore permanently discarded. The script also lacks a cleanup trap and does not validate whether the target paths are test fixtures. Consequently, normal execution of the supplied test is sufficient to cause data loss; no malformed input is required. ### Attack Path 1. A user or AI agent runs `references/test-cross-platform.sh` to verify compatibility. 2. The script resolves `~/.openclaw/workspace` as the active workspace. 3. Existing `pending-items.md` and `complete ...[truncated 887 chars]- Remediation
View remediation