gnezim/clawsec
1
0
Fork 0
mirror of https://github.com/prompt-security/clawsec.git synced 2026-06-19 16:31:20 +03:00
Code Issues Packages Projects Releases Wiki Activity

fix(openclaw-audit-watchdog): escape shell env interpolation in setup_cron

Browse Source
This commit is contained in:
davida-ps
2026-02-16 09:11:40 +00:00
committed by David Abutbul
parent f0fdf7b983
commit 5e389cb582
1 changed files with 13 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
skills/openclaw-audit-watchdog/scripts/setup_cron.mjs
+13 -2
View File
@@ -53,7 +53,16 @@ function oneline(v) {
return String(v ?? "")
.replace(/[\r\n]+/g, " ")
.replace(/"/g, "\\\"")
.trim();
}
function escapeForShellEnvVar(v) {
return String(v ?? "")
.replace(/[\r\n]+/g, " ")
.replace(/\\/g, "\\\\")
.replace(/\$/g, "\\$")
.replace(/`/g, "\\`")
.replace(/"/g, "\\\"")
.trim();
}
@@ -66,7 +75,9 @@ function defaultInstallDir() {
}
function buildAgentMessage({ dmChannel, dmTo, hostLabel, installDir }) {
const safeDir = oneline(installDir || "");
const safeDir = escapeForShellEnvVar(installDir || "");
const escapedHostLabel = escapeForShellEnvVar(hostLabel);
return [
"Run daily openclaw security audits and deliver report (DM + email).",
"",
@@ -74,7 +85,7 @@ function buildAgentMessage({ dmChannel, dmTo, hostLabel, installDir }) {
`Email: ${COMPANY_EMAIL} (local sendmail)`,
"",
"Execute:",
`- Run via exec: cd "${safeDir}" && PROMPTSEC_HOST_LABEL="${oneline(hostLabel)}" ./scripts/runner.sh`,
`- Run via exec: cd "${safeDir}" && PROMPTSEC_HOST_LABEL="${escapedHostLabel}" ./scripts/runner.sh`,
"",
"Output requirements:",
"- Print the report to stdout (cron deliver will DM it).",