T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate-image.sh:350- Finding
Shell Startup-File Injection Through Unsanitized Configuration Values
- Content
View full analysis
&2 read -r api_key if [ -z "$api_key" ]; then echo "Error: API key cannot be empty" >&2 exit 1 fi # Check if config already exists (avoid duplicate append) if ! grep -q "^export LISTENHUB_API_KEY=" "$shell_rc" 2>/dev/null; then echo "export LISTENHUB_API_KEY=\"$api_key\"" >> "$shell_rc" else # If exists, replace sed_inplace "$shell_rc" "s|^export LISTENHUB_API_KEY=.*|export LISTENHUB_API_KEY=\"$api_key\"|" fi export LISTENHUB_API_KEY="$api_key" ``` ```bash echo -n " Image save location (default: ~/Downloads): " >&2 read -r output_dir # Default to ~/Downloads if [ -z "$output_dir" ]; then output_dir="$HOME/Downloads" fi # Expand ~ symbol output_dir="${output_dir/#\~/$HOME}" # Create directory if not exists mkdir -p "$output_dir" # Check if config already exists (avoid duplicate append) if ! grep -q "^export LISTENHUB_OUTPUT_DIR=" "$shell_rc" 2>/dev/null; then echo "export LISTENHUB_OUTPUT_DIR=\"$output_dir\"" >> "$shell_rc" else sed_inplace "$shell_rc" "s|^export LISTENHUB_OUTPUT_DIR=.*|export LISTENHUB_OUTPUT_DIR=\"$output_dir\"|" fi export LISTENHUB_OUTPUT_DIR="$output_dir" ``` ### Technical Analysis The script embeds user-controlled API-key and output-directory values directly into executable shell startup files such as `.zshrc`, `.bashrc`, or `.profile`. The values are placed inside double-quoted shell assignments without shell-safe encoding or validation. Shell expressions such as command substitutions and backticks remain active when the startup file is subsequently parsed. For example, a value containing `$(command)` can be written into an `export` statement and executed whenever a future shell sources that file. The replacement branch also interpolates the values directly into a `sed ...[truncated 1599 chars]- Remediation
View remediation