openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

False positive security flag for AWS CLI skill using execFile (no shell interpolation) #151

New Issue
Open
opened 2026-02-15 17:15:56 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:15:56 -05:00
Owner
Copy Link
Copy Source

Originally created by @HypertextAssassinRajith on GitHub (Feb 12, 2026).

Summary

My OpenClaw skill (awscli) is currently flagged as "Suspicious (High Confidence)" by ClawHub security scanning.

However, the skill does NOT use shell interpolation or unsanitized command execution.

I believe this is a false positive triggered by detection of child_process usage.

Technical Details

The skill:

  • Uses execFile() instead of exec()
  • Does NOT use shell execution
  • Passes arguments as an array (no string interpolation)
  • Enforces strict instance whitelist validation
  • Requires explicit environment variables:
    • AWS_REGION
    • ALLOWED_INSTANCES
  • Documents required AWS CLI and IAM permissions in SKILL.md

Example execution pattern:

execFile("aws", [
  "lightsail",
  "reboot-instance",
  "--instance-name",
  input.instance,
  "--region",
  REGION
]);

Repo : Github

Originally created by @HypertextAssassinRajith on GitHub (Feb 12, 2026). ## Summary My OpenClaw skill (`awscli`) is currently flagged as "Suspicious (High Confidence)" by ClawHub security scanning. However, the skill does NOT use shell interpolation or unsanitized command execution. I believe this is a false positive triggered by detection of `child_process` usage. ## Technical Details The skill: - Uses `execFile()` instead of `exec()` - Does NOT use shell execution - Passes arguments as an array (no string interpolation) - Enforces strict instance whitelist validation - Requires explicit environment variables: - AWS_REGION - ALLOWED_INSTANCES - Documents required AWS CLI and IAM permissions in SKILL.md Example execution pattern: ```js execFile("aws", [ "lightsail", "reboot-instance", "--instance-name", input.instance, "--region", REGION ]); ``` Repo : [Github](https://github.com/HypertextAssassinRajith/awscli)
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#151
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?