T09 · Insecure Skill Coding Practices
Error
- Location
scripts/generate_bat.py:24- Finding
Windows Batch Command Injection Through Unescaped Message and Recipient Values
- Content
View full analysis
nul echo ===================================== echo 微信RPA - 发送消息 echo ===================================== echo. echo 好友: {friend} echo 消息: {message[:50]}{'...' if len(message) > 50 else ''} echo. echo 正在执行，请勿移动鼠标键盘... echo. cd /d "{SKILL_DIR}" python "{SCRIPTS_DIR}\\send_message.py" "{friend}" "{message}" echo. echo 执行完成，按任意键退出... pause >nul ''' with open(output_path, "w", encoding="utf-8") as f: f.write(bat_content) ``` ### Technical Analysis The `friend` and `message` parameters are inserted directly into executable Windows batch-file content. Quoting values with double quotes does not safely isolate them in `cmd.exe`. An attacker can include a double quote followed by command separators or redirection characters such as `&`, `|`, `>`, `<`, or a newline to terminate the intended argument and introduce another command. The same untrusted values are also interpolated into `echo` commands, creating additional injection points. Windows-specific expansions such as `%VARIABLE%` can alter generated content at execution time. The implementation performs no validation, canonicalization, or CMD-compatible escaping before writing the `.bat` file. The dangerous operation does not occur while the file is generated. It occurs when the generated file is subsequently executed, as explicitly instructed by the script. ### Attack Path 1. An attacker influences the recipient or message passed to: ```text python generate_bat.py send ``` 2. The attacker supplies a value con ...[truncated 1020 chars]- Remediation
View remediation
`, `<`, parentheses, carriage returns, and newlines. ]]>