T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:62- Finding
Shell Command Injection in Process Termination Function
- Content
View full analysis
bool: """ 关闭应用程序 示例: close_app("notepad.exe") """ import os os.system(f"taskkill /F /IM {process_name}") return True ``` ### Technical Analysis The `close_app` function directly interpolates `process_name` into a command passed to `os.system`. On Windows, `os.system` invokes the command interpreter, so shell metacharacters contained in `process_name` are interpreted as command syntax rather than as part of a literal process name. No validation, escaping, allowlisting, or argument separation is applied. If an untrusted caller can influence `process_name`, the caller can append an additional command using Windows command-shell operators. This converts an intended process-termination operation into arbitrary command execution. The function also always returns `True`, regardless of whether `taskkill` succeeds, which can conceal failed or manipulated execution. ### Attack Path 1. The skill or a generated automation script accepts a process name from an untrusted request, workflow variable, external record, or other attacker-influenced source. 2. The attacker supplies a value containing a valid process name followed by a command-shell control operator and an additional command. 3. The value is inserted without validation into: `taskkill /F /IM {process_name}` 4. `os.system` passes the constructed string to the Windows command interpreter. 5. The interpreter runs `taskkill` and then interprets and executes the appended command. 6. The injected command runs with the same user privileges and environmental access as the Python process executing the skill. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the automation ag ...[truncated 449 chars]- Remediation
View remediation
bool: if not re.fullmatch(r"[A-Za-z0-9._-]+\.exe", process_name): raise ValueError("Invalid process name") result = subprocess.run( ["taskkill", "/F", "/IM", process_name], shell=False, check=False, capture_output=True, text=True, ) return result.returncode == 0 ``` Apply the following additional controls: 1. Prefer `psutil` process APIs when possible, avoiding command-line construction entirely. 2. Validate process names against a strict syntax and, where practical, an explicit allowlist of applications the skill is authorized to terminate. 3. Never use `shell=True` or `os.system` with attacker-influenced values. 4. Return or log the real execution result instead of unconditionally reporting success. 5. Run the automation process with least privilege so a compromised operation has limited system access. 6. Require user confirmation before terminating security-sensitive, system, or unrelated processes. ]]>