Summary
LobsterAI contains an external control of file path vulnerability in the skills:delete IPC handler. A crafted skill can provide an attacker-controlled source directory through _meta.json, allowing recursive deletion of user-writable directories when a user later uninstalls the skill.
LobsterAI contains an external control of file path vulnerability in the skills:delete IPC handler. A crafted skill can provide an attacker-controlled source directory through _meta.json, allowing recursive deletion of user-writable directories when a user later uninstalls the skill.
Affected context
The issue occurs in LobsterAI deployments that support installing and uninstalling skills through the affected IPC workflow. It becomes risky when a user installs a skill from an untrusted or insufficiently reviewed source, the skill's _meta.json is not inspected by security scanning, and the uninstall handler trusts its openclawSourceDir value while deleting files.
The issue occurs in LobsterAI deployments that support installing and uninstalling skills through the affected IPC workflow. It becomes risky when a user installs a skill from an untrusted or insufficiently reviewed source, the skill's _meta.json is not inspected by security scanning, and the uninstall handler trusts its openclawSourceDir value while deleting files.
Exploit preconditions
- Attack surface: LobsterAI skill installation and uninstallation workflows
- Required access: Ability to distribute or promote a crafted skill that a user will install
- Trigger point: Execution of the
skills:deleteIPC handler during skill uninstallation - Why exploitation is possible: The handler trusts a path from skill metadata and uses it for recursive deletion without adequately constraining it to an approved skill directory
- Attack surface: LobsterAI skill installation and uninstallation workflows
- Required access: Ability to distribute or promote a crafted skill that a user will install
- Trigger point: Execution of the
skills:deleteIPC handler during skill uninstallation - Why exploitation is possible: The handler trusts a path from skill metadata and uses it for recursive deletion without adequately constraining it to an approved skill directory
Why this happens
The vulnerability results from treating externally supplied metadata as a trusted filesystem path. The uninstall logic uses the openclawSourceDir value from _meta.json without sufficiently canonicalizing, validating, and restricting the resolved location to an expected directory. This behavior maps to CWE-73: External Control of File Name or Path, where attacker-influenced path data controls filesystem operations.
The vulnerability results from treating externally supplied metadata as a trusted filesystem path. The uninstall logic uses the openclawSourceDir value from _meta.json without sufficiently canonicalizing, validating, and restricting the resolved location to an expected directory. This behavior maps to CWE-73: External Control of File Name or Path, where attacker-influenced path data controls filesystem operations.
Potential impact
- An attacker-controlled skill may cause deletion of arbitrary user-writable directories
- User files, application data, or configuration may be permanently removed
- The user's home directory or other accessible data may be disrupted
- Availability of LobsterAI and dependent workflows could be affected
- Data loss may occur without requiring direct access to the victim's filesystem
- An attacker-controlled skill may cause deletion of arbitrary user-writable directories
- User files, application data, or configuration may be permanently removed
- The user's home directory or other accessible data may be disrupted
- Availability of LobsterAI and dependent workflows could be affected
- Data loss may occur without requiring direct access to the victim's filesystem
General mitigation guidance
Mitigation generally focuses on reducing trust in skill metadata and enforcing filesystem boundaries.
Common defensive patterns include:
- Derive uninstall paths from trusted installation records rather than package-provided metadata
- Canonicalize paths before use and require them to remain beneath an approved skill root
- Reject absolute paths, traversal components, symbolic-link escapes, and unexpected path types
- Make security scanners inspect all metadata fields that can influence filesystem operations
- Use narrowly scoped filesystem permissions and avoid granting the application unnecessary write access
- Require explicit confirmation for destructive operations outside a tightly bounded installation directory
Mitigation generally focuses on reducing trust in skill metadata and enforcing filesystem boundaries.
Common defensive patterns include:
- Derive uninstall paths from trusted installation records rather than package-provided metadata
- Canonicalize paths before use and require them to remain beneath an approved skill root
- Reject absolute paths, traversal components, symbolic-link escapes, and unexpected path types
- Make security scanners inspect all metadata fields that can influence filesystem operations
- Use narrowly scoped filesystem permissions and avoid granting the application unnecessary write access
- Require explicit confirmation for destructive operations outside a tightly bounded installation directory
How teams detect issues like this
Organizations can identify similar risks through:
- Static analysis rules for filesystem deletion APIs receiving values from package metadata or IPC parameters
- Code review checks for recursive deletion without canonical path validation and trusted-root enforcement
- Tests covering traversal, absolute paths, symbolic links, missing metadata, and paths outside the installation directory
- Runtime audit logging for skill installation, metadata changes, and recursive deletion requests
- Policy enforcement that blocks destructive filesystem operations outside approved application data directories
- Automated security review tools that trace untrusted path values into file and directory operations
Organizations can identify similar risks through:
- Static analysis rules for filesystem deletion APIs receiving values from package metadata or IPC parameters
- Code review checks for recursive deletion without canonical path validation and trusted-root enforcement
- Tests covering traversal, absolute paths, symbolic links, missing metadata, and paths outside the installation directory
- Runtime audit logging for skill installation, metadata changes, and recursive deletion requests
- Policy enforcement that blocks destructive filesystem operations outside approved application data directories
- Automated security review tools that trace untrusted path values into file and directory operations
