T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:46
- Finding
- Command Injection Through an Unquoted User-Controlled Workspace Path<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 46–48 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```markdown After required files for one agent are confirmed: 1. If agent does not exist, create it: - `openclaw agents add <id> --workspace <path>` ``` ### Technical Analysis The workflow collects the workspace path from the user and later instructs the agent to interpolate that value into a shell command. The command template does not quote `<path>` or require execution through a structured argument-array API. Although agent IDs are restricted to lowercase letters, digits, and hyphens, no equivalent validation is specified for workspace paths. If the rendered command is passed to a shell, metacharacters in a malicious workspace value can terminate or alter the intended command and introduce additional commands. For example, a workspace value containing a command separator could cause the shell to interpret the remainder as a separate command. The vulnerability depends on the agent rendering this template with the supplied value and invoking it through a shell rather than a non-shell process API. ### Attack Path 1. An attacker or untrusted user requests creation of an agent. 2. The attacker supplies a workspace path containing shell metacharacters, such as: ```text /tmp/work; <attacker-command> ``` 3. The agent substitutes that value into the documented command: ```sh openclaw agents add example --workspace /tmp/work; <attacker-command> ``` 4. The agent executes the rendered string through a shell. 5. The shell runs the intended `openclaw` command and then executes the injected command with the operating-system privileges of the agent process. ### Impact Assessment Successful exploitation can provide arbitrary command execution under the account running the agent. The attacker could read or modify files accessible to that account, alter agent workspaces, expose lo ...[truncated 302 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Use a process-execution API that accepts the executable and arguments as a structured array, without invoking a shell: ```text ["openclaw", "agents", "add", id, "--workspace", workspace] ``` 2. If shell execution is unavoidable, quote every substituted argument: ```sh openclaw agents add "$id" --workspace "$workspace" ``` 3. Validate the workspace path before execution: - Reject control characters, newlines, and null bytes. - Require an absolute path or explicitly resolve permitted relative paths. - Normalize the path and enforce any intended allowed-root restriction. - Do not construct a command by concatenating raw user input. 4. Preserve the existing agent-ID allowlist and validate it immediately before command execution. 5. Update the Skill instructions to explicitly prohibit shell-string interpolation and require confirmation that displays the normalized agent ID and workspace path as data, not as an executable command. 6. Add tests covering paths containing spaces, quotes, semicolons, command substitutions, redirection operators, and newlines to verify that they remain a single inert argument. ]]>