T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:46- Finding
Command Injection Through an Unquoted User-Controlled Workspace Path
- Content
View full analysis
--workspace ` ``` ### Technical Analysis The workflow collects the workspace path from the user and later instructs the agent to interpolate that value into a shell command. The command template does not quote `` or require execution through a structured argument-array API. Although agent IDs are restricted to lowercase letters, digits, and hyphens, no equivalent validation is specified for workspace paths. If the rendered command is passed to a shell, metacharacters in a malicious workspace value can terminate or alter the intended command and introduce additional commands. For example, a workspace value containing a command separator could cause the shell to interpret the remainder as a separate command. The vulnerability depends on the agent rendering this template with the supplied value and invoking it through a shell rather than a non-shell process API. ### Attack Path 1. An attacker or untrusted user requests creation of an agent. 2. The attacker supplies a workspace path containing shell metacharacters, such as: ```text /tmp/work; ``` 3. The agent substitutes that value into the documented command: ```sh openclaw agents add example --workspace /tmp/work; ``` 4. The agent executes the rendered string through a shell. 5. The shell runs the intended `openclaw` command and then executes the injected command with the operating-system privileges of the agent process. ### Impact Assessment Successful exploitation can provide arbitrary command execution under the account running the agent. The attacker could read or modify files accessible to that account, alter agent workspaces, expose lo ...[truncated 302 chars]- Remediation
View remediation