dream(host-adapters): fix host-openclaw YAML/shell injection via spec.name (evaluated)

[ruvnet]

MetaHarness Dream Cycle, 2026-08-29. Rotation slot: host-adapters (slot 4,
scan: kernel,sdk). Full detail, ledger check, learning signals, competitor
research, and recommendations: #245.

Hypothesis

Given @metaharness/host-openclaw's skillMarkdown() and installScript()
functions, when a HarnessSpec.name reaching them through any caller that
bypasses the CLI's kebab-case validateHarnessName gate (direct SDK call,
web-UI, --from-existing) contains YAML- or shell-metacharacters, then the
generated SKILL.md frontmatter and install-openclaw.sh should render it
as an inert string rather than corrupting the YAML document or executing
injected shell commands — subject to: byte-identical output for any name
without those characters, 0 regressions in the existing 19-test suite, and
new regression tests must fail against pre-patch code (red/green).

Candidate

Single file, one conceptual change: packages/host-openclaw/src/index.ts.
spec.name was interpolated unescaped into (a) a YAML frontmatter name:
value in skillMarkdown(), and (b) a bash comment line and several
double-quoted shell strings in installScript(). This is the 4th
confirmed instance of the same vulnerability class already fixed in
host-hermes (#188, merged) and disclosed-but-unmerged in host-github-actions
(#212) and host-rvm (#224). Fixed with the exact same escaping conventions
as those two prior fixes for reviewer familiarity:

• yamlValueSafe() / yamlDq() — bare when a safe identifier and not a
  YAML-reserved bare scalar, quoted+escaped otherwise (mirrors host-hermes's
  yamlKey()).
• shellDq() — escapes backslash/double-quote/dollar/backtick for bash
  double-quoted strings (mirrors host-rvm's shellDq()).
• commentSafe() — strips CR/LF for raw #-comment lines (mirrors
  host-rvm's commentSafe()).

Checked host-copilot and host-prime-agent (the other adapters with similar
spec.name/a.name interpolation) for the same class: both only
interpolate into markdown body text, not a YAML/shell control position —
not exploitable, correctly left unfixed.

Evaluation Receipt

Deterministic code-correctness fix (no LLM calls needed; LLM_EVAL=available
but unused). 6 new tests added to packages/host-openclaw/__tests__/openclaw.test.ts
covering: YAML mapping-value injection (colon-space, raw newline) and shell
injection (comment-line newline, $() command substitution, embedded
double-quote, backtick substitution). All 6 verified to fail against
pre-patch code (direct pre-patch run) and pass post-patch.

Baseline Comparison

host-openclaw suite: 19/19 (baseline) → 25/25 (candidate), 0 regressions.
@metaharness/bench (imports the adapter): 148/148, 0 regressions.
Full monorepo npm run build: clean, 0 errors, all 4 phases. tsc --noEmit:
clean.

Darwin Lineage

Not run — CLI-codegen escaping fix, not a genome/routing/topology/prompt/
tool/tier parameter; no bounded-evolution mutation surface applies (same
reasoning as #188/#212/#224).

Flywheel Evidence

Not applicable — generator-CLI correctness fix, not a harness-runtime
promotion candidate. Evidence retained as committed test files + gist +
issue #245.

Reward Hack Check

No test/benchmark weakened — 6 new tests, all additive, no existing
assertions loosened or thresholds changed. Independently confirmed by a
separate adversarial-critique subagent (not this candidate's author),
which re-verified the red/green claim itself via git stash.

Security Review

No new dependency, no new external destination. Net effect: closes a 4th
instance of an established RCE-class injection pattern. Independent critic
verdict: ACCEPT-WITH-CAVEATS — sound fix; one inherited (not new)
data-fidelity gap noted (YAML_RESERVED_BARE doesn't cover YAML-1.1
y/n/hex/underscore-grouped numerics — copied verbatim from
host-hermes's already-merged convention, not a new regression). The critic
also independently confirmed #224 (host-rvm shell RCE) has not merged
into main — that RCE is live on main right now.

Regression Analysis

None found. yamlValueSafe/shellDq/commentSafe are byte-identical
passthroughs for any name matching the pre-existing safe-identifier
convention (all pre-existing tests pass unchanged).

ADR

None — this hardens an existing, already-reviewed pattern (same escaping
conventions as #188/#224); not a new architectural decision.

Research Gist

docs/dream-cycle/2026-08-29-gist.md (GIST=LOCAL — no gist-creation tool
available in this session, matching every prior Dream Cycle night).
Includes OWASP MCP Top 10 grounding, competitor comparison (LangGraph,
AutoGen, CrewAI, OpenAI Agents SDK, Claude Agent SDK — none ship a
comparable built-in threat-model artifact), and the systemic
"no shared escaping utility exists" finding.

Issue

#245 (full findings, ledger check, 0/10-merged backlog signal, recommended
human actions).

Witness

session_commit : 6f8c60216f47eac391a076fe27fd804470a07e10
report_sha256  : 96dbc309c4e2357f1e0534bd5eed9bfd02efa1e1b80b5faf33a151be7b7a6cbd
witness        : 3dcc14d14758f54091248a1f1ae292e97688b17152ce20d4ed4df7f073bb757b

Merge Policy

Human review required. Do not self-merge. Do not autonomously promote
Flywheel state.

Recommendation: ACCEPT for this PR itself (small, additive, fully
green, red/green-proven, independently critiqued). The more urgent human
action is triaging the review backlog: #212 and #224 (both disclosed
security fixes, the latter an RCE that is unpatched on main right now)
should be reviewed before more Dream Cycle nights add a 5th instance of
this same bug class.

---

Generated by Claude Code