T09 · Insecure Skill Coding Practices
- Location
image-gen.sh:23- Finding
Arbitrary Shell Execution Through Executable .env Configuration
- Content
View full analysis
Vulnerability Details
File Location:
image-gen.sh:23-32
Vulnerability Type: Unsafe execution of configuration file contents
Risk Level: Mediumbash # 检查 .env 文件 if [[ ! -f "$ENV_FILE" ]]; then log_error "未找到 .env 文件" echo "请在 $SCRIPT_DIR 目录下创建 .env 文件" echo "参考 .env.example 文件格式" exit 1 fi # 加载环境变量 source "$ENV_FILE"Technical Analysis
The script loads its configuration with the Bash
sourcebuiltin. This treats every line in.envas executable shell code rather than parsing it as inert key-value data.The Skill only needs to read a small set of configuration values, including
IMAGE_API_BASE_URL,IMAGE_API_KEY,IMAGE_MODEL,IMAGE_SIZE, andIMAGE_ASPECT_RATIO. Granting the configuration file the ability to execute arbitrary commands exceeds the minimum privileges necessary for image generation.Exploitation requires an attacker to create or modify the Skill-local
.envfile. This could occur through a compromised installation process, another vulnerable component with write access, an untrusted shared workspace, or social engineering that causes a user to install a malicious configuration file.Attack Path
- An attacker obtains the ability to write to the
.envfile besideimage-gen.sh. - The attacker adds a shell command to the file while retaining plausible API configuration entries, for example:
bash IMAGE_API_BASE_URL=https://api.example.invalid IMAGE_API_KEY=example malicious_command_here - A user or agent invokes
image-gen.shfor its legitimate image-generation purpose. - Bash reaches
source "$ENV_FILE"and executes the attacker-controlled command. - The command runs with the same operating-system identity and permissions as the invoking user or agent.
Impact Assessment
Successful exploitation provides arbitrary command execution with the invoking user's privileges. The attacker could rea ...[truncated 379 chars]
- An attacker obtains the ability to write to the
- Remediation
View remediation
Remediation Suggestions
- Do not load
.envthroughsource,.,eval, or another shell-execution mechanism. - Parse only an explicit allowlist of supported keys and treat all values as data.
- Reject malformed lines, duplicate security-sensitive keys, command substitutions, shell operators, and unsupported variable names.
- Validate
IMAGE_API_BASE_URLas an HTTPS URL and validate model, size, and aspect-ratio values against expected formats or allowlists. - Require the configuration file to be owned by the expected user and not writable by group or other users. Recommended permissions are
0600. - Resolve the documentation mismatch:
README.mddirects users to~/.openclaw/workspace/.env, while the implementation loads.envfrom the Skill directory. - Prefer receiving the API key from a dedicated secret manager or inherited process environment rather than storing it in the Skill package directory.
- Do not load