AI SkillHub — 知识策展系统

Access to sensitive environment variables detected

${GITHUB_TOKEN}

The user-provided or derived `keyword` is directly interpolated into multiple `exec` commands (e.g., `mkdir`, `cp`, `git commit`). This allows an attacker to inject arbitrary shell commands by crafting a malicious `keyword` containing shell metacharacters.

mkdir -p skillhub_repo/skills/{keyword}, git -C skillhub_repo commit -m 'Add skill [{keyword}]'

The `url` parameter, which is user-controlled, is directly passed to a `python3` script via the `exec` tool. If the Python script or the shell command itself does not properly sanitize the `url`, it could lead to command injection.

command": "python3 ~/.openclaw/scripts/yt_transcript.py {url} 2>&1"

Content fetched from a user-provided URL is directly inserted into a shell 'here-document' (`cat > /tmp/raw_content.md << 'RAWEOF' ... {content} RAWEOF`). A malicious URL could return content containing the `RAWEOF` delimiter or other shell escape sequences, allowing an attacker to inject arbitrary commands.

command": "cat > /tmp/raw_content.md << 'RAWEOF'\n...\n{Step 2 返回的完整内容}\nRAWEOF"

The skill performs `git clone` and `git push` operations using an environment variable `GITHUB_TOKEN`. If command injection is successful, an attacker could potentially modify the remote repository URL or exfiltrate other files from the agent's environment to an attacker-controlled repository.

git clone "https://${GITHUB_TOKEN}@github.com/${GITHUB_REPO}.git" skillhub_repo

The skill explicitly instructs the agent to use an 'exec' tool to run arbitrary shell commands, including git clone, file writes, and a Python script. This enables unrestricted code execution on the host system.

"tool": "exec",
"command": "cd /tmp && rm -rf skillhub_repo && git clone ...

The skill embeds the GITHUB_TOKEN environment variable directly into a git clone URL via shell interpolation. This exposes the token in process lists, shell history, and potentially in logs. The token is used to authenticate to GitHub without any validation of the target repository.

git clone \"https://${GITHUB_TOKEN}@github.com/${GITHUB_REPO}.git\"

User-supplied URL and keyword values are interpolated directly into shell commands without sanitization or quoting. An attacker could craft a malicious keyword or URL containing shell metacharacters (semicolons, backticks, $()) to execute arbitrary commands.

"command": "cat > /tmp/raw_content.md << 'RAWEOF'\n...\n- URL: {url}\n- 关键词: {keyword}" and mkdir -p skillhub_repo/skills/{keyword}

The skill instructs the exec tool to run a Python script located at ~/.openclaw/scripts/yt_transcript.py with a user-controlled URL as argument. This executes code from a potentially untrusted path and passes unsanitized user input as an argument.

"command": "python3 ~/.openclaw/scripts/yt_transcript.py {url} 2>&1"

The skill automatically pushes fetched web content and generated summaries to an external GitHub repository. The target repository is controlled by GITHUB_REPO environment variable, which could be attacker-controlled, enabling exfiltration of processed data.

git clone "https://${GITHUB_TOKEN}@github.com/${GITHUB_REPO}.git" skillhub_repo && ... && git -C skillhub_repo push origin ${GITHUB_BRANCH:-main}

The skill fetches arbitrary user-supplied URLs via web_fetch without any validation or allowlist. An attacker could supply internal network URLs (e.g., http://169.254.169.254/latest/meta-data/) to perform Server-Side Request Forgery against internal infrastructure.

"url": "{url}",
"extractMode": "markdown"

User-supplied URLs are fetched and their full content is passed directly into subsequent prompts and shell commands (Step 5 and Step 4). A malicious web page could contain injected instructions that manipulate the agent's reasoning or inject shell metacharacters into exec commands.

"input": "{Step 2 返回的完整内容}" and "command": "cat > /tmp/raw_content.md << 'RAWEOF'\n...\n{Step 2 返回的完整内容}\nRAWEOF"

The final notification to the user includes the user-controlled `keyword` and `url`. An attacker could craft these inputs to display misleading information or phishing links, potentially tricking the human overseer.

✅ Skill 已完成：【{keyword}】 ... 📦 来源：{url}