T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:163- Finding
Execution of an Unreviewed Workspace-Controlled Audio Helper
- Content
View full analysis
/scripts/xuanzang-audio.sh /tmp/xz_read_NNN.txt /xuanzang-NNN-voice.mp3 ``` Script stdout: `XZAUDIO_OK` indicates success; `XZAUDIO_SKIP` indicates a normal NO_TTS skip; `XZAUDIO_ERR/WARN` indicates that audio is unavailable. > Reference script: `~/clawd/scripts/xuanzang-audio.sh` ``` The excerpt above is an English rendering of the operative instructions at the cited lines. The actual command executed by the Skill is: ```bash bash /scripts/xuanzang-audio.sh /tmp/xz_read_NNN.txt /xuanzang-NNN-voice.mp3 ``` ### Technical Analysis The Skill instructs the Agent to invoke a shell script located in the consuming workspace or at `~/clawd/scripts/xuanzang-audio.sh`. That helper is not included in the audited project and therefore is outside the package's review and integrity boundary. Executing a workspace-controlled file explicitly through `bash` gives that file the ability to run arbitrary shell commands with the same operating-system privileges as the Agent. No signature, checksum, ownership validation, permission check, or trusted-path validation is specified before execution. The command's arguments do not themselves demonstrate command injection because they are shown as positional arguments. The security issue is the trust placed in the script body at an unverified external path. ### Attack Path 1. An attacker gains the ability to create or replace `/scripts/xuanzang-audio.sh` or `~/clawd/scripts/xuanzang-audio.sh`. This could occur through another compromi ...[truncated 1033 chars]- Remediation
View remediation