T09 · Insecure Skill Coding Practices
Error
- Location
references/templates/agents/story-researcher.md:123- Finding
Shell Command Injection Through Unvalidated Research Parameters and Web-Derived URLs
- Content
View full analysis
a.href&&!a.href.includes("google.com")&&!a.href.includes("bing.com")&&!a.href.includes("javascript:")).slice(0,10).map(a=>({text:a.innerText.trim().substring(0,100),href:a.href})))' ``` ```bash # Navigate using the extracted URL agent-browser --cdp {cdp_port} eval "window.location.replace('{extracted URL}')" agent-browser --cdp {cdp_port} wait 5000 # Verify page loading agent-browser --cdp {cdp_port} snapshot 2>&1 | head -20 # Extract page text agent-browser --cdp {cdp_port} eval 'document.body.innerText.substring(0,8000)' ``` ### Technical Analysis The researcher agent is granted the `Bash` tool and is instructed to construct shell commands by directly substituting three potentially untrusted values: 1. The externally supplied `cdp_port` parameter. 2. A search term derived from the research request. 3. A target URL extracted from an untrusted search-result page. These values are not constrained by a strict grammar and are not encoded for both the shell and JavaScript contexts. The apparent JavaScript quoting does not provide shell protection. In particular, the search term and extracted URL are placed inside a ...[truncated 2461 chars]- Remediation
View remediation