T09 · Insecure Skill Coding Practices
- Location
scripts/bootstrap_openclaw_workflow.sh:9- Finding
Untrusted Path Arguments Are Written into YAML Without Escaping
- Content
View full analysis
Vulnerability Details
File Location:
scripts/bootstrap_openclaw_workflow.sh, lines 9-18
Vulnerability Type: YAML configuration injection
Risk Level: HighVulnerable Code
bash DOCS_REPO_ROOT="$1" LINUX_REPO_PATH="$2" BASE="$DOCS_REPO_ROOT/kernel/openclaw" mkdir -p "$BASE/config" "$BASE/state/run_history" "$BASE/plans" "$BASE/patches" "$BASE/logs" WF="$BASE/config/workflow.yaml" if [[ ! -f "$WF" ]]; then cat > "$WF" <<YAML project: linux_repo: $LINUX_REPO_PATH docs_repo: $DOCS_REPO_ROOTTechnical Analysis
The script accepts
DOCS_REPO_ROOTandLINUX_REPO_PATHas command-line arguments and interpolates them directly into an unquoted YAML scalar. Shell quoting of the assignments prevents ordinary shell word splitting, but it does not make the values safe for insertion into YAML.An argument may contain newlines, comments, scalar indicators, document separators, anchors, aliases, or additional mapping entries. These characters are retained when the here-document is expanded. Consequently, an attacker who controls either argument can alter the structure of the generated
workflow.yaml, cause duplicate keys, or produce malformed YAML.The generated configuration controls agents, project paths, policy limits, issue synchronization, and mailing behavior. The exact effect of duplicate keys or multiple YAML documents depends on the downstream YAML parser. Some parsers reject duplicates, while others accept the first or last value. At minimum, malformed input can prevent the workflow from loading. If the consumer accepts injected configuration fields, workflow behavior can also be modified.
The existing-file check limits this issue to initial creation or environments where the configuration file has been removed. It does not protect a first-time bootstrap using attacker-controlled arguments.
Attack Path
- An attacker influences a path passed to `bootstrap_openclaw_workflo ...[truncated 1297 chars]
- Remediation
View remediation
Remediation Suggestions
- Generate the configuration through a YAML serialization library rather than string interpolation.
- Pass path values to the serializer as string values so newlines and YAML metacharacters are escaped correctly.
- Reject path arguments containing NUL bytes, carriage returns, line feeds, or other control characters.
- Resolve and validate both paths before writing the configuration:
- Require absolute paths.
- Normalize paths with
realpath. - Confirm that the expected repositories exist.
- Reject unexpected parent-directory traversal or disallowed roots.
- Validate the completed file against a strict schema that rejects unknown properties, duplicate keys, and multiple YAML documents.
- Write to a securely created temporary file, validate it, and atomically rename it into place only after validation succeeds.
- Retain the existing no-overwrite behavior, but require explicit approval before replacing or regenerating an existing configuration.