T09 · Insecure Skill Coding Practices
- Location
SKILL.md:93- Finding
Shell Command Injection Through a User-Derived Image Prompt
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 93-97
Vulnerability Type: Shell command injection
Risk Level: Highbash python "{baseDir}/../nano-banana2-apiyi/scripts/generate_image.py" \ --prompt "高质量英文提示词" \ --filename "{workspace}\output\beauty-$(date +%Y-%m-%d-%H-%M-%S).png" \ --aspect-ratio "16:9" \ --size "2K"The non-English string in the source snippet is the original placeholder for the user-derived English prompt.
Technical Analysis
The documented execution flow places an English image prompt derived from user input directly inside a double-quoted shell argument. The skill does not require a structured process API, shell escaping, validation, or rejection of shell metacharacters.
Double quotes do not neutralize every shell construct. In common shells, command substitutions such as
$()and backticks are evaluated inside double quotes. A quotation mark in the generated prompt could also terminate the argument early and expose subsequent metacharacters to the shell. Therefore, an attacker may craft an interior-design request that causes shell syntax to survive prompt transformation and reach the command invocation.The vulnerability is in the documented invocation pattern. The referenced sibling image-generation script is not part of the audited artifact, so its own security properties could not be evaluated.
Attack Path
- An attacker submits an image-generation request containing shell syntax disguised as prompt content.
- The skill converts the request into an English image prompt while preserving the malicious syntax.
- After the user confirms generation, the prompt is interpolated into the documented
--prompt "..."shell command. - The shell evaluates command substitution or syntax exposed by a terminating quotation mark.
- The injected operating-system command runs with the privileges and environment of the agent process.
For example, a prompt ...[truncated 764 chars]
- Remediation
View remediation
Remediation Suggestions
- Do not construct a shell command by interpolating prompt text.
- Invoke the Python interpreter through a structured process API with an argument array and shell processing disabled. Pass the prompt as one literal argument.
- If the host framework only exposes a shell interface, use a platform-specific, well-tested argument-escaping routine rather than manual quotation.
- Validate prompt input and reject control characters and unexpected shell syntax as defense in depth. Validation must not replace shell-free execution.
- Prefer passing large or complex prompts through standard input or a securely created data file, then provide only a controlled file path to the generation script.
- Construct output paths through filesystem path APIs. Generate filenames in application code rather than using shell command substitution.
- Run image generation in a sandbox with minimal filesystem permissions, no unnecessary credentials, restricted network access, and resource limits.
- Add regression tests covering quotation marks,
$(), backticks, semicolons, pipes, redirections, newlines, and platform-specific metacharacters.