T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:26
- Finding
- Shell Command Injection Through Unescaped Reminder Content<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:26-41` **Vulnerability Type**: Shell command injection through user-controlled command arguments **Risk Level**: High ### Vulnerable Code ```bash openclaw cron add \ --name "我的提醒" \ --at "2026-04-08T09:00:00.000Z" \ --tz "Asia/Shanghai" \ --session isolated \ --message "直接发送以下文字到飞书，不需要调用任何工具：开会时间到了！" \ --timeout-seconds 180 \ --delete-after-run \ --announce \ --channel feishu \ --to user:ou_XXXXXXXXXXXXXXXX \ --description "一次性提醒示例" ``` The same unsafe command-construction pattern also appears in the recurring reminder templates at `SKILL.md:43-73`. The documented workflow in `README.md:15-18` states that natural-language reminder content is parsed and used to create these cron tasks. ### Technical Analysis The skill instructs an agent to construct a Bash command using reminder data derived from natural-language user input. Values such as the task name, reminder message, description, and destination are placed directly inside double-quoted shell arguments. Bash double quotes do not prevent command substitution. Constructs such as `$(command)` and backticks are still evaluated before the `openclaw` process receives the argument. The skill provides no validation, escaping, allowlist, or requirement to use a structured process-execution API with shell interpretation disabled. For example, if attacker-controlled reminder text containing `$(malicious_command)` is inserted into the `--message` value and the generated command is executed through a shell, Bash evaluates `malicious_command` locally during task creation. The resulting standard output is then substituted into the argument passed to `openclaw`. The vulnerability is conditional on the agent or runtime implementing these templates by constructing and executing a shell command. A structured argument-array invocation with shell processing disabled would prevent this exploitation method. ### Attack Path 1. An attac ...[truncated 1392 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Avoid shell command strings.** Invoke `openclaw` through a process API that accepts an argument array and explicitly disables shell processing, such as an API equivalent to `spawn(command, args, { shell: false })`. 2. **Treat all reminder fields as untrusted data.** Never concatenate the task name, message, description, time expression, timezone, or destination into executable shell text. 3. **Validate structured fields.** - Require Feishu user destinations to match the expected `user:ou_...` format. - Require group destinations to match the expected `channel:oc_...` format. - Validate timezone values against an approved allowlist. - Parse and validate ISO timestamps and cron expressions before task creation. 4. **Prevent option injection.** Pass each value as a distinct argument and use an end-of-options delimiter where supported. 5. **Use robust shell quoting only as a last resort.** If shell execution cannot be eliminated, apply a well-tested platform-specific escaping routine rather than manual replacement. 6. **Require confirmation.** Display the parsed schedule, recipient, and exact reminder text to the user before creating the task. 7. **Add adversarial tests.** Test reminder fields containing quotes, backslashes, `$()`, backticks, semicolons, newlines, leading dashes, redirections, and Unicode control characters. 8. **Document the safe execution requirement.** Explicitly state that agents must not execute generated command strings through Bash or another command shell. ]]>