T09 · Insecure Skill Coding Practices
Error
- Location
SKILL.md:57- Finding
Potential Shell Command Injection Through an Unquoted Campaign Identifier
- Content
View full analysis
--source paid --data '{"spend": ..., "budget": ..., "days_elapsed": ..., "days_total": ...}'`, then `ledger.py trend --source paid --field spend` for the spend line across prior checks. ``` ### Technical Analysis The documented ledger commands place the `` value into a shell command without quoting, validation, or an explicit requirement to invoke the process through a shell-free argument array. Campaign identifiers can originate from user-supplied exports and campaign names, which the skill itself identifies as untrusted input at `SKILL.md:53`. If an agent replaces `` with a campaign name containing shell metacharacters and passes the resulting command to a shell, characters such as command separators, command substitutions, or redirection operators may be interpreted as shell syntax rather than campaign-name data. The same unsafe pattern appears in both the `record` and `trend` command examples on line 57. This creates a command-injection boundary even though the skill separately instructs the agent not to execute instructions embedded in campaign names. The vulnerable command template does not technically enforce that policy. Exploitation depends on the host constructing a command string from the template and executing it through a shell. The referenced `ledger.py` implementation is not included in this standalone package, so its own input handling and any additional safeguards could not be evaluated. ### Attack Path 1. An attacker creates or renames an advertising campaign so its name contains shell metacharact ...[truncated 1356 chars]- Remediation
View remediation