prevent Zip Slip and symlink following in skill packaging#1
Open
aether-ai-agent wants to merge 388 commits intomainfrom
Open
prevent Zip Slip and symlink following in skill packaging#1aether-ai-agent wants to merge 388 commits intomainfrom
aether-ai-agent wants to merge 388 commits intomainfrom
Conversation
…enclaw#20233) * fix(protocol): preserve booleans in AnyCodable bridge * fix(protocol): align AnyCodable bool-first type dispatch
SecurityScorecard's STRIKE research recently identified over 40,000 exposed OpenClaw gateway instances, with 35.4% running known-vulnerable versions. The gateway already performs an npm update check on startup and compares against the registry every 24 hours — but the result is only logged to the server console. The control UI has zero visibility into whether the running version is outdated, which means operators have no idea they're exposed unless they happen to read server logs. OpenClaw's user base is broadening well beyond developers who live in terminals. Self-hosters, small teams, and non-technical operators are deploying gateways and relying on the control dashboard as their primary management interface. For these users, security has to be surfaced where they already are — not hidden behind CLI output they will never see. Making version awareness frictionless and actionable is a prerequisite for reducing that 35.4% number. This PR adds a sticky red warning banner to the top of the control UI content area whenever the gateway detects it is running behind the latest published version. The banner includes an "Update now" button wired to the existing update.run RPC (the same mechanism the config page already uses), so operators can act immediately without switching to a terminal. Server side: - Cache the update check result in a module-level variable with a typed UpdateAvailable shape (currentVersion, latestVersion, channel) - Export a getUpdateAvailable() getter for the rest of the process - Add an optional updateAvailable field to SnapshotSchema (backward compatible — old clients ignore it, old servers simply omit it) - Include the cached update status in buildGatewaySnapshot() so it is delivered to every UI client on connect and reconnect UI side: - Add updateAvailable to GatewayHost, AppViewState, and the app's reactive state so it flows through the standard snapshot pipeline - Extract updateAvailable from the hello snapshot in applySnapshot() - Render a .update-banner.callout.danger element with role="alert" as the first child of <main>, before the content header - Wire the "Update now" button to runUpdate(state), the same controller function used by the config tab - Use position:sticky and negative margins to pin the banner edge-to-edge at the top of the scrollable content area
…packaging This commit implements critical security fixes for vulnerability OC-22 (CVSS 7.7, CWE-426) in the skill packaging system. ## Security Fixes 1. Symlink Detection and Rejection - Added check to detect and reject symlinks in skill directories - Prevents attackers from including arbitrary system files via symlink following - Rejects packaging with error message if any symlink is found 2. Path Traversal (Zip Slip) Prevention - Added validation for arcname paths in zip archives - Rejects paths containing ".." (directory traversal) - Rejects absolute paths that could escape skill directory - Prevents attackers from overwriting system files during extraction ## Attack Vectors Mitigated - Symlink following: Attacker creates symlink to /etc/passwd or other sensitive files in skill directory → now rejected - Zip Slip: Attacker crafts paths with "../../root/.bashrc" to overwrite system files during extraction → now rejected ## Changes - Modified: skills/skill-creator/scripts/package_skill.py - Added symlink check (line 73-76) - Added path validation check (line 84-87) - Enhanced error messages for security violations - Added: skills/skill-creator/scripts/test_package_skill.py - Comprehensive test suite with 11 test cases - Tests for symlink rejection - Tests for path traversal prevention - Tests for normal file packaging - Tests for edge cases (nested files, multiple files, large skills) ## Testing All 11 tests pass: - test_normal_file_packaging: Normal files packaged correctly - test_symlink_rejection: Symlinks detected and rejected - test_symlink_to_sensitive_file: Sensitive file symlinks rejected - test_zip_slip_prevention: Normal subdirectories work properly - test_absolute_path_prevention: Path validation logic tested - test_nested_files_allowed: Properly nested files allowed - test_multiple_files_with_symlink_mixed: Single symlink fails entire package - test_large_skill_with_many_files: Large skills handled correctly - test_missing_skill_directory: Error handling verified - test_file_instead_of_directory: Error handling verified - test_missing_skill_md: Error handling verified
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
14 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
This pull request implements critical security fixes for vulnerability OC-22 to prevent Zip Slip and symlink following attacks in the skill packaging system.
Attack Vectors Fixed
Changes
Modified Files
New Files
Security Improvements
Before: Skill packaging could include arbitrary files via symlinks or overwrite system files via Zip Slip
After:
Test Plan
All 11 tests passing:
Security Considerations
Related Documentation