T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:124
- Finding
- Shell Command Injection Through an Unquoted User-Controlled URL## Vulnerability Details **File Location**: `SKILL.md`, lines 124–130 **Vulnerability Type**: Shell command injection **Risk Level**: High ### Vulnerable Code ```bash # Check: curl -sI {url} | grep -i 'x-cache\|cf-cache\|x-cdn' # Compression: Must have brotli or gzip # Check: curl -sI -H "Accept-Encoding: br,gzip" {url} | grep -i content-encoding # HTTP/2 or HTTP/3 # Check: curl -sI --http2 {url} | head -1 ``` ### Technical Analysis The `{url}` placeholder is inserted into shell command examples without quoting, URL validation, or an end-of-options delimiter. The skill accepts natural-language commands containing user-supplied audit URLs and directs an agent to perform these checks. If an agent replaces `{url}` verbatim and executes the resulting command through a shell, shell metacharacters in the supplied value—such as command separators, substitutions, or redirections—will be interpreted as shell syntax rather than as part of the URL. Merely prefixing a malicious value with an HTTP URL does not prevent exploitation. The vulnerability is present in documentation rather than an executable script, so exploitation depends on an agent operationalizing the examples through a shell. Nevertheless, executing recommended commands is consistent with the skill's audit workflow. ### Attack Path 1. An attacker provides an audit request containing a crafted URL with shell metacharacters and an appended command. 2. The agent follows the server-optimization playbook in `SKILL.md`. 3. The agent substitutes the supplied value directly for `{url}` in one of the documented `curl` commands. 4. The agent invokes the generated command through a shell. 5. The shell interprets the injected syntax and executes the attacker's appended command. 6. The injected command runs with the same operating-system identity, environment access, filesystem permissions, and network access as the agent process. ### Impact Assessment Successful exploitation permits arbitrary command executi ...[truncated 542 chars]
- Remediation
- ## Remediation Suggestions 1. Parse the supplied target with a standards-compliant URL parser and allow only explicitly supported schemes, preferably `https` and, where necessary, `http`. 2. Reject malformed targets, embedded credentials, control characters, and unexpected URL components. 3. Execute `curl` without a shell by passing the URL as a distinct argument in an argument array. 4. If shell execution is unavoidable, place the validated URL in a variable, quote every expansion, and use an end-of-options delimiter: ```bash curl -sI -- "$url" | grep -iE 'x-cache|cf-cache|x-cdn' curl -sI -H 'Accept-Encoding: br,gzip' -- "$url" | grep -i content-encoding curl -sI --http2 -- "$url" | head -n 1 ``` 5. Do not rely on quoting alone as the validation boundary. Add network-target controls to reject loopback, link-local, private, metadata-service, and otherwise prohibited destinations if untrusted users can supply URLs. 6. Update the skill instructions to explicitly prohibit direct interpolation of natural-language input into shell commands. 7. Run audit tooling under a dedicated, least-privileged account with restricted filesystem access, minimal environment secrets, outbound-network controls, and execution timeouts.