T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:195
- Finding
- Command Injection Through Unsafe URL Interpolation in a Shell Command<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 195-205 **Vulnerability Type**: Shell command injection caused by unsafe construction of a JSON request body **Risk Level**: High ### Vulnerable Code ```bash curl -sS -X POST "https://api.marswave.ai/openapi/v1/content/extract" \ -H "Authorization: Bearer $LISTENHUB_API_KEY" \ -H "Content-Type: application/json" \ -d '{ "source": { "type": "url", "uri": "https://en.wikipedia.org/wiki/Topology" } }' ``` The workflow instructs the Agent to replace the example URI with the user-supplied URL: ```json { "source": { "type": "url", "uri": "{url}" } } ``` ### Technical Analysis The Skill accepts an arbitrary user-provided HTTP(S) URL and directs the Agent to construct a `curl` command whose JSON body is enclosed in a single-quoted shell string. The only documented validation is that the value must be an HTTP(S) URL. An otherwise valid URL can contain an apostrophe and shell metacharacters. If the Agent performs direct textual substitution of `{url}` into the demonstrated command, an apostrophe in the URL terminates the shell's single-quoted JSON argument. Subsequent characters can then be interpreted as shell syntax rather than request data. JSON quoting does not provide shell quoting, and checking only the URL scheme does not prevent this condition. This is an exploitable coding pattern because the Skill explicitly requires shell-based `curl` requests while providing no safe serialization or argument-passing mechanism for the untrusted value. ### Attack Path 1. An attacker supplies a crafted URL that begins with an accepted `http://` or `https://` scheme but contains an apostrophe followed by shell syntax. 2. The Agent accepts the URL because the documented validation only requires an HTTP(S) URL. 3. The user confirms extraction as required by the workflow. 4. The Agent substitutes the attacker-controlled URL into the single-quoted JSON body shown b ...[truncated 1086 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Never interpolate a user-controlled URL directly into a shell command or quoted JSON literal. 2. Serialize the request body with a JSON-aware tool such as `jq`: ```bash REQUEST_BODY=$(jq -n --arg uri "$USER_URL" '{ source: { type: "url", uri: $uri } }') curl -sS -X POST "https://api.marswave.ai/openapi/v1/content/extract" \ -H "Authorization: Bearer $LISTENHUB_API_KEY" \ -H "Content-Type: application/json" \ --data-binary "$REQUEST_BODY" ``` 3. Prefer invoking an HTTP client through a structured tool API that accepts the URL, headers, and JSON body as separate arguments, avoiding shell interpretation entirely. 4. Parse the supplied URL using a proper URL parser. Permit only `http` and `https`, reject embedded credentials in the authority component, and reject malformed control characters. 5. Do not rely on allowlisting characters alone as the primary defense. Safe argument separation and JSON serialization must remain mandatory. 6. Add tests covering apostrophes, quotes, command substitutions, semicolons, newlines, control characters, and URLs with encoded special characters. 7. Avoid printing or persisting authorization headers, and warn users before submitting signed URLs or URLs containing sensitive query parameters to the third-party extraction service. ]]>