T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:33
- Finding
- Shell Command Injection Through Unquoted User-Controlled Path Arguments<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:33-34` **Vulnerability Type**: Shell command injection through unsafe command construction **Risk Level**: High ### Vulnerable Code ```markdown 5. If the runtime permits shell or exec, use: - `python3 "{baseDir}/scripts/run.py" --input <input-file> --output <output-file>` ``` The input and output placeholders above are rendered in English while preserving the command structure found in the source. ### Technical Analysis The Skill instructs an agent to construct and execute a shell command using input and output paths without quoting or validating those arguments. If either placeholder is derived from untrusted user input, shell metacharacters, command substitutions, redirection operators, or whitespace can alter the intended command. The Python script itself does not invoke a shell. The vulnerability arises when an agent follows the Skill instruction by interpolating user-controlled values into a command string and passing that string to a shell. Quoting only `{baseDir}` does not protect the two unquoted path arguments. Exploitability depends on the hosting agent exposing a shell-style execution tool and inserting requested paths directly into the documented command. ### Attack Path 1. An attacker invokes the Skill and supplies an input or output filename containing shell syntax. 2. The agent follows `SKILL.md:33-34` and substitutes that value into the unquoted command template. 3. The agent submits the resulting string to a shell or shell-compatible execution tool. 4. The shell interprets the embedded syntax rather than treating the entire value as one filename. 5. The injected command executes with the operating-system privileges and environment access of the agent process. ### Impact Assessment Successful exploitation permits arbitrary command execution under the account running the agent. The resulting scope can include: - Reading files accessible to the agent account. - Modifying ...[truncated 401 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Require invocation through an argument-array API that does not use a shell, for example the equivalent of: ```python subprocess.run( ["python3", str(script_path), "--input", input_path, "--output", output_path], shell=False, check=True, ) ``` 2. Update `SKILL.md` to explicitly prohibit direct string interpolation into shell commands. 3. If a shell cannot be avoided, apply platform-appropriate shell escaping to every dynamic argument rather than relying on visual quotation. 4. Validate input and output paths before execution. Reject control characters, line breaks, null bytes, and unexpected path formats. 5. Prefer a dedicated execution tool with separately encoded arguments over a free-form shell tool. 6. Add automated tests using filenames containing spaces, quotes, command substitutions, separators, and redirection characters to verify that they are handled strictly as filenames. ]]>