T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/generate-image.sh:350
- Finding
- Shell Startup-File Injection Through Unsanitized Configuration Values<![CDATA[ ## Vulnerability Details **File Location**: `scripts/generate-image.sh:350-393` **Vulnerability Type**: Persistent shell configuration injection **Risk Level**: High ### Vulnerable Code ```bash echo -n " Please paste your API key: " >&2 read -r api_key if [ -z "$api_key" ]; then echo "Error: API key cannot be empty" >&2 exit 1 fi # Check if config already exists (avoid duplicate append) if ! grep -q "^export LISTENHUB_API_KEY=" "$shell_rc" 2>/dev/null; then echo "export LISTENHUB_API_KEY=\"$api_key\"" >> "$shell_rc" else # If exists, replace sed_inplace "$shell_rc" "s|^export LISTENHUB_API_KEY=.*|export LISTENHUB_API_KEY=\"$api_key\"|" fi export LISTENHUB_API_KEY="$api_key" ``` ```bash echo -n " Image save location (default: ~/Downloads): " >&2 read -r output_dir # Default to ~/Downloads if [ -z "$output_dir" ]; then output_dir="$HOME/Downloads" fi # Expand ~ symbol output_dir="${output_dir/#\~/$HOME}" # Create directory if not exists mkdir -p "$output_dir" # Check if config already exists (avoid duplicate append) if ! grep -q "^export LISTENHUB_OUTPUT_DIR=" "$shell_rc" 2>/dev/null; then echo "export LISTENHUB_OUTPUT_DIR=\"$output_dir\"" >> "$shell_rc" else sed_inplace "$shell_rc" "s|^export LISTENHUB_OUTPUT_DIR=.*|export LISTENHUB_OUTPUT_DIR=\"$output_dir\"|" fi export LISTENHUB_OUTPUT_DIR="$output_dir" ``` ### Technical Analysis The script embeds user-controlled API-key and output-directory values directly into executable shell startup files such as `.zshrc`, `.bashrc`, or `.profile`. The values are placed inside double-quoted shell assignments without shell-safe encoding or validation. Shell expressions such as command substitutions and backticks remain active when the startup file is subsequently parsed. For example, a value containing `$(command)` can be written into an `export` statement and executed whenever a future shell sources that file. The replacement branch also interpolates the values directly into a `sed ...[truncated 1599 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not automatically modify executable shell startup files. Prefer an OS credential manager or a dedicated application configuration file. 2. Store non-secret settings in a file under a dedicated configuration directory, such as `${XDG_CONFIG_HOME:-$HOME/.config}/listenhub/config`. 3. Store API keys in an OS keychain or a dedicated file with mode `0600`. 4. If startup-file modification must remain available, require explicit user approval and display the exact destination and proposed change. 5. Validate API keys using the service's documented character set and expected prefix instead of accepting arbitrary shell syntax. 6. Validate output directories and reject newline, carriage-return, NUL, command-substitution, backtick, and shell-control characters. 7. Encode shell values using a shell-aware mechanism such as `printf '%q'` rather than direct interpolation. 8. Avoid interpolating untrusted data into `sed` expressions. Use a structured configuration format or safely escape all replacement and delimiter characters. 9. Write changes through a securely created temporary file, preserve permissions, and atomically replace the destination after validation. ]]>