T09 · Insecure Skill Coding Practices
Error
- Location
- SKILL.md:93
- Finding
- Shell Command Injection Through a User-Derived Image Prompt## Vulnerability Details **File Location**: `SKILL.md`, lines 93-97 **Vulnerability Type**: Shell command injection **Risk Level**: High ```bash python "{baseDir}/../nano-banana2-apiyi/scripts/generate_image.py" \ --prompt "高质量英文提示词" \ --filename "{workspace}\output\beauty-$(date +%Y-%m-%d-%H-%M-%S).png" \ --aspect-ratio "16:9" \ --size "2K" ``` The non-English string in the source snippet is the original placeholder for the user-derived English prompt. ### Technical Analysis The documented execution flow places an English image prompt derived from user input directly inside a double-quoted shell argument. The skill does not require a structured process API, shell escaping, validation, or rejection of shell metacharacters. Double quotes do not neutralize every shell construct. In common shells, command substitutions such as `$()` and backticks are evaluated inside double quotes. A quotation mark in the generated prompt could also terminate the argument early and expose subsequent metacharacters to the shell. Therefore, an attacker may craft an interior-design request that causes shell syntax to survive prompt transformation and reach the command invocation. The vulnerability is in the documented invocation pattern. The referenced sibling image-generation script is not part of the audited artifact, so its own security properties could not be evaluated. ### Attack Path 1. An attacker submits an image-generation request containing shell syntax disguised as prompt content. 2. The skill converts the request into an English image prompt while preserving the malicious syntax. 3. After the user confirms generation, the prompt is interpolated into the documented `--prompt "..."` shell command. 4. The shell evaluates command substitution or syntax exposed by a terminating quotation mark. 5. The injected operating-system command runs with the privileges and environment of the agent process. For example, a prompt ...[truncated 764 chars]
- Remediation
- ## Remediation Suggestions - Do not construct a shell command by interpolating prompt text. - Invoke the Python interpreter through a structured process API with an argument array and shell processing disabled. Pass the prompt as one literal argument. - If the host framework only exposes a shell interface, use a platform-specific, well-tested argument-escaping routine rather than manual quotation. - Validate prompt input and reject control characters and unexpected shell syntax as defense in depth. Validation must not replace shell-free execution. - Prefer passing large or complex prompts through standard input or a securely created data file, then provide only a controlled file path to the generation script. - Construct output paths through filesystem path APIs. Generate filenames in application code rather than using shell command substitution. - Run image generation in a sandbox with minimal filesystem permissions, no unnecessary credentials, restricted network access, and resource limits. - Add regression tests covering quotation marks, `$()`, backticks, semicolons, pipes, redirections, newlines, and platform-specific metacharacters.