rpm-packager

• Outcome: Review
• Latest audit: Sep 11, 2026 · 4:07 AM UTC
• Version: 1.0.0

Overview

This RPM packaging skill matches its stated purpose, but its bundled build script can turn crafted package metadata into command execution or unintended file writes during a build.

Install only if you understand RPM build workflows and will use trusted package metadata. Run builds as an unprivileged user, preferably in mock or another isolated build environment, and avoid using untrusted package names, versions, releases, or RPM_BUILDER_NAME values until the script adds strict validation.

A.I.G

Vulnerability Patterns

• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review
• Embedded Malicious Code: Ships malicious scripts inside the skill and executes them locally

Findings (2)

T09 · Insecure Skill Coding Practices

Error

• Location: scripts/build-rpm.sh:6
• Finding: RPM SPEC Injection Through Unvalidated Package Metadata<![CDATA[ ## Vulnerability Details **File Location**: `scripts/build-rpm.sh`, lines 6-15, 96-131, and 135-138 **Vulnerability Type**: Injection of attacker-controlled RPM macros and SPEC directives **Risk Level**: High ### Vulnerable Code ```bash SOURCE_DIR="${1:-.}" PACKAGE_NAME="${2:-$(basename "$SOURCE_DIR")}" VERSION="${3:-1.0.0}" RELEASE="${4:-1}" # Configurable build directory (default: ~/rpmbuild) RPM_BUILD_DIR="${RPM_BUILD_DIR:-$HOME/rpmbuild}" # Builder name for changelog (anonymized by default) RPM_BUILDER_NAME="${RPM_BUILDER_NAME:-OpenClaw Builder}" ``` ```bash generate_spec_file() { local SPEC_FILE="$RPM_BUILD_DIR/SPECS/${PACKAGE_NAME}.spec" log_info "Generating SPEC file: $SPEC_FILE" cat > "$SPEC_FILE" << EOF Name: ${PACKAGE_NAME} Version: ${VERSION} Release: ${RELEASE}%{?dist} Summary: ${PACKAGE_NAME} application License: MIT URL: https://example.com/${PACKAGE_NAME} Source0: %{name}-%{version}.tar.gz BuildRequires: gcc make Requires: glibc %description ${PACKAGE_NAME} - Built from source automatically %prep %setup -q %build %configure make %{?_smp_mflags} %install make install DESTDIR=%{buildroot} %files %defattr(-,root,root,-) %{_bindir}/${PACKAGE_NAME} %changelog * $(date +%a\ %b\ %d\ %Y) ${RPM_BUILDER_NAME} - ${VERSION}-${RELEASE} - Initial package build EOF log_info "SPEC file generated" echo "$SPEC_FILE" } ``` ```bash build_rpm() { local SPEC_FILE="$1" log_info "Building RPM package..." rpmbuild -ba "$SPEC_FILE" 2>&1 | tee "$RPM_BUILD_DIR/BUILDLOGS/${PACKAGE_NAME}-${VERSION}.log" ``` ### Technical Analysis The script accepts `PACKAGE_NAME`, `VERSION`, and `RELEASE` from positional arguments and `RPM_BUILDER_NAME` from the environment without validating their syntax. These values are inserted directly into an RPM SPEC file. Shell quoting around `cat > "$SPEC_FILE"` protects the destination filename from shell word ...[truncated 1820 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Apply strict allowlists before using package metadata: - Package name: permit only an explicitly supported subset such as ASCII letters, digits, `.`, `_`, `+`, and `-`. - Version and release: permit only RPM-compatible characters required by the project. - Reject `%`, newlines, carriage returns, control characters, whitespace, path separators, and shell metacharacters. 2. Validate `RPM_BUILDER_NAME` separately as display-only text. Reject newlines, control characters, and RPM macro introducers. 3. Fail closed when any value does not match the allowlist; do not attempt to remove individual dangerous characters from otherwise untrusted input. 4. Generate the SPEC file through a mechanism that explicitly escapes values for RPM syntax rather than relying on shell quoting. 5. Separate immutable SPEC structure from user-controlled descriptive metadata. Do not permit callers to provide raw SPEC fragments. 6. Run RPM builds as a dedicated, unprivileged account inside an isolated build environment such as a container or correctly configured `mock` environment. 7. Add regression tests covering percent-prefixed macros, multiline input, control characters, and malformed package metadata. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: scripts/build-rpm.sh:6
• Finding: Path Traversal and Unsafe Output File Handling<![CDATA[ ## Vulnerability Details **File Location**: `scripts/build-rpm.sh`, lines 6-9, 80-88, 96-100, and 135-138 **Vulnerability Type**: Path traversal and symbolic-link file overwrite **Risk Level**: Medium ### Vulnerable Code ```bash SOURCE_DIR="${1:-.}" PACKAGE_NAME="${2:-$(basename "$SOURCE_DIR")}" VERSION="${3:-1.0.0}" RELEASE="${4:-1}" ``` ```bash create_source_tarball() { log_info "Creating source tarball..." local TARBALL_NAME="${PACKAGE_NAME}-${VERSION}.tar.gz" local TARBALL_PATH="$RPM_BUILD_DIR/SOURCES/$TARBALL_NAME" # Get absolute path local ABS_SOURCE_DIR ABS_SOURCE_DIR="$(cd "$SOURCE_DIR" && pwd)" tar -czf "$TARBALL_PATH" -C "$(dirname "$ABS_SOURCE_DIR")" "$(basename "$ABS_SOURCE_DIR")" ``` ```bash generate_spec_file() { local SPEC_FILE="$RPM_BUILD_DIR/SPECS/${PACKAGE_NAME}.spec" log_info "Generating SPEC file: $SPEC_FILE" cat > "$SPEC_FILE" << EOF ``` ```bash build_rpm() { local SPEC_FILE="$1" log_info "Building RPM package..." rpmbuild -ba "$SPEC_FILE" 2>&1 | tee "$RPM_BUILD_DIR/BUILDLOGS/${PACKAGE_NAME}-${VERSION}.log" ``` ### Technical Analysis `PACKAGE_NAME` and `VERSION` are incorporated into archive, SPEC, and log paths without rejecting path separators or traversal components. Shell quoting prevents argument splitting but does not stop path resolution by the operating system. Values containing components such as `..` can cause a destination to resolve outside `SOURCES`, `SPECS`, or `BUILDLOGS`. The archive is created with `tar -czf`, the SPEC is opened using shell redirection, and the log is opened by `tee`. These operations can create or truncate files. No canonical-path containment check is performed, and there is no explicit protection against pre-existing symbolic links at the destination. Exploitation is constrained by generated filename suffixes and by the filesystem permissions of the builder account, but output can still be redirected o ...[truncated 1336 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions 1. Reject `/`, backslashes, `..` path components, absolute paths, control characters, and empty values in all metadata used in filenames. 2. Reuse strict RPM metadata allowlists so accepted values cannot encode filesystem paths. 3. Canonicalize every destination and verify that it remains beneath the expected `SOURCES`, `SPECS`, or `BUILDLOGS` directory before writing. 4. Create output files using exclusive, no-follow semantics where supported. Refuse to overwrite symbolic links and unexpected existing files. 5. Ensure the build root and its subdirectories are owned by the build user and are not writable by untrusted local users. 6. Consider creating a private build directory with restrictive permissions for each invocation rather than reusing a predictable shared directory tree. 7. Add tests for absolute paths, nested separators, repeated `..` components, and pre-existing symbolic-link destinations. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Rogue Agent: Self-Modification, Session Persistence
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code

Findings (6)

Session Persistence

Medium

• Category: Rogue Agent

Content

---
name: rpm-packager
description: Build RPM packages from source code for CentOS/RHEL systems. Use when user needs to: (1) package software source into installable RPM, (2) create SPEC files, (3) build packages for CentOS 7/8/9 or RHEL, (4) prepare software for distribution on RPM-based Linux systems.
---

# RPM Packager Skill

• Confidence: 60% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 2. Check Prerequisites

Required tools on CentOS/RHEL (**requires sudo privileges**):
```bash
sudo yum install rpm-build mock gcc make
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 2. Check Prerequisites

Required tools on CentOS/RHEL (**requires sudo privileges**):
```bash
sudo yum install rpm-build mock gcc make
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

### 2. Check Prerequisites

Required tools on CentOS/RHEL (**requires sudo privileges**):
```bash
sudo yum install rpm-build mock gcc make
```

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if [ ${#missing[@]} -ne 0 ]; then
        log_error "Missing required tools: ${missing[*]}"
        log_info "Install with: sudo yum install rpm-build mock"
        exit 1
    fi

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

if [ ${#missing[@]} -ne 0 ]; then
        log_error "Missing required tools: ${missing[*]}"
        log_info "Install with: sudo yum install rpm-build mock"
        exit 1
    fi

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.