vrr/spawn
2
0
Fork 0
mirror of https://github.com/OpenRouterTeam/spawn.git synced 2026-08-31 01:54:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 2

security: fix command injection in cline auth via remote env var expansion (#1473)

Browse source 
All 9 cline.sh scripts embedded OPENROUTER_API_KEY directly into the
cloud_run command string, allowing shell metacharacter injection on the
remote server. Fix by escaping the dollar sign (\${OPENROUTER_API_KEY})
so the variable is expanded on the remote machine where it's already
set via agent_env_vars()/generate_env_config, not locally before being
passed to cloud_run.

Agent: security-auditor

Co-authored-by: B <6723574+louisgv@users.noreply.github.com>
Co-authored-by: Claude Sonnet 4.5 <noreply@anthropic.com>
This commit is contained in:
A 2026-02-19 09:25:16 -08:00 • committed by GitHub
parent e2d6aa1444
commit d8785c3d0b
No known key found for this signature in database
GPG key ID: B5690EEEBB952194
9 changed files with 9 additions and 9 deletions
Download patch file Download diff file Expand all files Collapse all files

2
aws/cline.sh
View file

@ -20,7 +20,7 @@ agent_env_vars() {
}
agent_configure() {
log_step "Authenticating Cline with OpenRouter..."
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
}
agent_launch_cmd() { echo 'source ~/.zshrc && cline'; }

2
daytona/cline.sh
View file

@ -23,7 +23,7 @@ agent_env_vars() {
agent_configure() {
log_step "Authenticating Cline with OpenRouter..."
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
}
agent_launch_cmd() {

2
digitalocean/cline.sh
View file

@ -20,7 +20,7 @@ agent_env_vars() {
}
agent_configure() {
log_step "Authenticating Cline with OpenRouter..."
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
}
agent_launch_cmd() { echo 'source ~/.zshrc && cline'; }

2
fly/cline.sh
View file

@ -23,7 +23,7 @@ agent_env_vars() {
agent_configure() {
log_step "Authenticating Cline with OpenRouter..."
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
}
agent_launch_cmd() {

2
gcp/cline.sh
View file

@ -20,7 +20,7 @@ agent_env_vars() {
}
agent_configure() {
log_step "Authenticating Cline with OpenRouter..."
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
}
agent_launch_cmd() { echo 'source ~/.zshrc && cline'; }

2
hetzner/cline.sh
View file

@ -20,7 +20,7 @@ agent_env_vars() {
}
agent_configure() {
log_step "Authenticating Cline with OpenRouter..."
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
}
agent_launch_cmd() { echo 'source ~/.zshrc && cline'; }

2
local/cline.sh
View file

@ -23,7 +23,7 @@ agent_env_vars() {
agent_configure() {
log_step "Authenticating Cline with OpenRouter..."
cloud_run "source ~/.zshrc 2>/dev/null; cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
cloud_run "source ~/.zshrc 2>/dev/null; cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
}
agent_launch_cmd() {

2
ovh/cline.sh
View file

@ -20,7 +20,7 @@ agent_env_vars() {
}
agent_configure() {
log_step "Authenticating Cline with OpenRouter..."
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
}
agent_launch_cmd() { echo 'source ~/.zshrc && cline'; }

2
sprite/cline.sh
View file

@ -23,7 +23,7 @@ agent_env_vars() {
agent_configure() {
log_step "Authenticating Cline with OpenRouter..."
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"${OPENROUTER_API_KEY}\""
cloud_run "source ~/.zshrc && cline auth -p openrouter -k \"\${OPENROUTER_API_KEY}\""
}
agent_launch_cmd() {