T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:33- Finding
Shell Command Injection Through Unquoted User-Controlled Path Arguments
- Content
View full analysis
--output ` ``` The input and output placeholders above are rendered in English while preserving the command structure found in the source. ### Technical Analysis The Skill instructs an agent to construct and execute a shell command using input and output paths without quoting or validating those arguments. If either placeholder is derived from untrusted user input, shell metacharacters, command substitutions, redirection operators, or whitespace can alter the intended command. The Python script itself does not invoke a shell. The vulnerability arises when an agent follows the Skill instruction by interpolating user-controlled values into a command string and passing that string to a shell. Quoting only `{baseDir}` does not protect the two unquoted path arguments. Exploitability depends on the hosting agent exposing a shell-style execution tool and inserting requested paths directly into the documented command. ### Attack Path 1. An attacker invokes the Skill and supplies an input or output filename containing shell syntax. 2. The agent follows `SKILL.md:33-34` and substitutes that value into the unquoted command template. 3. The agent submits the resulting string to a shell or shell-compatible execution tool. 4. The shell interprets the embedded syntax rather than treating the entire value as one filename. 5. The injected command executes with the operating-system privileges and environment access of the agent process. ### Impact Assessment Successful exploitation permits arbitrary command execution under the account running the agent. The resulting scope can include: - Reading files accessible to the agent account. - Modifying ...[truncated 401 chars]- Remediation
View remediation