T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:58
- Finding
- Shell Command Injection Through Unsafe Prompt Interpolation## Vulnerability Details **File Location**: `SKILL.md`, lines 58-61 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash curl -s -X POST http://localhost:19836/trigger \ -H "Content-Type: application/json" \ -d '{"prompt":"<TASK_DESCRIPTION>"}' ``` ### Technical Analysis The documented workflow places the task description inside a single-quoted shell argument without defining any escaping or safe serialization procedure. The task description originates from user-controlled coding requests. If an agent implements the placeholder through direct textual substitution, an apostrophe in the task can terminate the single-quoted argument. Additional shell syntax can then be interpreted by the shell rather than being treated as JSON data. JSON metacharacters can also corrupt the request even when they do not result in command execution. This is an injection flaw at the boundary between untrusted prompt data, JSON serialization, and shell command construction. ### Attack Path 1. An attacker submits a coding task containing a single quote followed by shell metacharacters and a command. 2. The agent substitutes the task text directly for `<TASK_DESCRIPTION>`. 3. The injected quote terminates the shell's single-quoted `-d` argument. 4. The shell interprets the remaining attacker-controlled text as command syntax. 5. The injected command executes under the operating-system account running OpenClaw. ### Impact Assessment Successful exploitation permits arbitrary local command execution with the privileges of the OpenClaw process. Depending on those privileges, an attacker could read or modify workspace files, access user-readable credentials, alter source code, invoke network utilities, or compromise other resources available to the user account.
- Remediation
- ## Remediation Suggestions - Never interpolate task text directly into a shell command. - Construct the request body with a JSON serializer that correctly escapes all prompt content. - Pass prompt content through an environment variable or positional argument rather than embedding it in command source. - Prefer a direct HTTP client API that accepts a structured JSON object and does not invoke a shell. - If command-line tooling is required, use a pattern such as: ```bash payload="$(jq -n --arg prompt "$TASK_DESCRIPTION" '{prompt: $prompt}')" curl --fail --silent --show-error \ -X POST http://127.0.0.1:19836/trigger \ -H "Content-Type: application/json" \ --data-binary "$payload" ``` - Validate that generated requests remain valid JSON for prompts containing quotes, backslashes, newlines, command substitutions, and other shell metacharacters.